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ABSTRACT 


The concept of risk management provides the foundation of the homeland security 
enterprise. The United States of America faces numerous complex risks ranging from a 
series of natural hazards, pandemic disease, technological hazards, transnational criminal 
enterprises and acts of terrorism perpetrated by intelligent adversaries. The management 
of these risks requires a strategic collaborative effort from the intelligence and risk 
analysis communities and many stakeholders at all levels of government, including the 
private sector. Paradoxically, a decentralized collaborative approach to homeland security 
risk management may produce better results than a hierarchical central approach driven 
by the U.S. Department of Security, as this thesis suggests. Intelligence-Led Risk 
Management represents the fusion of intelligence with risk management in a 
collaborative framework to promote effective risk management throughout the homeland 
security enterprise. Concepts from strategic thought and planning, such as the Cyncfin 
Framework, Appreciative Inquiry, and Quantum Planning provide vehicles to promote 
collaboration and thoroughly explore the spectrum of risk management options available 
to the homeland security enterprise. Decentralization of homeland security risk 
management to states with the application of Intelligence-Led Risk Management through 
the network of fusion centers will promote collaboration and yield a stronger risk 
management culture within the homeland security enterprise. 
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I. INTRODUCTION 


A. PROBLEM STATEMENT - BACKGROUND 

Risk management is an essential component of the homeland security enterprise, 
but it is significantly fragmented and poorly coordinated among the numerous federal, 
state, local agencies, technical experts and private sector partners involved. This 
fragmentation and lack of coordination significantly detracts from a strategic approach 
for managing the wide range of risk within the homeland security enterprise. 

The Department of Homeland Security’s DHS Risk Lexicon defines risk 
management as, “the process of identifying, analyzing, assessing, and communicating 
risk and accepting, avoiding, transferring or controlling it to an acceptable level at an 
acceptable cost.” (United States. Department of Homeland Security (DHS), 2010). 
Several recent publications offer support for the need to identify ways of improving the 
risk analysis and risk management process within the homeland security enterprise. The 
National Emergency Management Association (NEMA) outlines a strategic view to 
enhance risk management through broadening collaborative partnerships, increasing the 
level of total hazard awareness, and emphasizing a full spectrum community to federal 
approach to risk management (National Emergency Management Association, 2009). 

Further justification for research in this area can be found in the DHS Nationwide 
Plan Review, which calls for the development of a comprehensive risk management 
process that is usable by all levels of government (Federal Emergency Management 
Agency (FEMA), 2010). The Quadrennial Homeland Security Review Report (QHSR) 
published in 2010 also identifies strategic goals and objectives to enhance the assessment 
and understanding of risk within the homeland security context. The problem of 
developing a standard approach to facilitate risk management across the homeland 
security enterprise that presents utility at each level of govermnent and with private 
sector partners remains exceptionally complex. The complexity of this problem is the 
product of the many different threats, hazards, vulnerability characteristics, and unique 
specialized assessment tools. 
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The existing approach to risk assessment and management is too hierarchical and 
centralized at the federal level of government. The current homeland security risk 
assessment and management process, as it applies to state and local governments, is 
focused on supporting federal decisions related to the distribution of grant funds, which 
provide the primary means for the federal government to influence homeland security 
priorities within state and local government (Masse, T, Rollins, J, & O’Neil, S, 2007). 
This limited top-down perspective of risk management does not facilitate collaborative 
approach to assess and manage homeland security risks with state, local, and private 
sector partners. The Department of Homeland Security recognizes the need to include 
more state and local input into the risk assessment and management process, but it does 
not appear to have a clearly defined plan of how to accomplish this (Committee to 
Review the Department of Homeland Security's Approach to Risk Analysis, 2010). This 
suggests that a decentralized approach to risk assessment and management focused 
within the construct of state and local government will improve national homeland 
security risk management. A compendium of risk assessment and management guidance, 
a suite of risk specific assessment tools, and access to technical experts to support state 
and local driven risk assessment and management strategies are needed to achieve a 
whole-of-nation approach to homeland security risk management. 

Intelligence remains an important aspect of homeland security risk assessment 
and management. Improved collaboration between homeland security risk analysts and 
the intelligence community is critical for producing effective threat assessments that 
provide utility in assessing and managing homeland security risk. The need to improve 
cross discipline collaboration between the intelligence community and risk assessment / 
management community exists, and greater collaboration between the two disciplines 
will advance the quality of threat assessments and thus risk management within the 
homeland security enterprise (Baker et ah, 2009). Greater collaboration between risk 
analysts and the intelligence community will also provide the opportunity to improve 
intelligence analysis (Willis, 2007). State and major urban area fusion centers provide a 
framework to facilitate collaboration between the intelligence community and risk 
analysts to support a decentralized approach to risk management driven by state and local 
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priorities. The prescribed capabilities for state and major urban area fusion centers 
suggest that the fusion centers can provide a structure to support this idea (United States. 
Department of Homeland Security, 2008). 

A multi-disciplinary coalition or alliance at each tier of government could 
provide a mechanism to coordinate risk management among different disciplines and 
agencies into a common voice instead of the current fragmented structure of competing 
autonomous entities that address certain aspects of homeland security risk. While the 
entirety of risk management is too diverse and complex to be wholly managed by any one 
organization, a collaborative alliance can provide a governance structure to support the 
efforts of the fifty states and U.S. Territories and the U.S. Department of Homeland 
Security to manage homeland security risk. 

B. RESEARCH QUESTIONS 

The primary question this thesis will examine is: How can the existing Homeland 
Security risk management framework be improved to better support decision making and 
allocation of resources within state and local governments? 

More specifically, this thesis will consider the following questions: How could we 
achieve a higher degree of collaboration between the intelligence community and risk 
analysts to support risk management within state and local governments? What factors 
influence successful collaboration, and how do they fit within a strategic planning 
framework? 

This thesis will attempt to support the following assertions: 

• A decentralized approach to risk assessment and management that is 
focused within the construct of state and local government will improve 
national homeland security risk management. 

• Improved collaboration between the intelligence community and the risk 
management community will improve the processes and products of both 
risk assessment and intelligence. 

• The capacity for collaboration exists within many agencies, but this fact 
must be recognized and joined with principles of strategic planning to 
improve risk management within the homeland security enterprise. 
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c. 


SIGNIFICANCE OF RESEARCH 


Exploring the issues associated with improving risk-based decision making is 
more important than ever. According to comments from the Comptroller General and 
Secretary of Homeland Security, the United States cannot afford to protect all things from 
all threats and hazards, therefore, critical decisions must be made about how to invest 
limited resources to achieve the greatest results (Jenkins, 2007 pp 1-2). The Comptroller 
General goes on to assert that the current fiscal policy of the United States is on an 
unstable course, and that course needs to be altered to avoid damage to the national 
economy, reduction in our standard of living, and damage to our national security 
(Jenkins, 2007 p. 12). Existing economic challenges at all levels of government present 
even more challenging resource allocation and prioritization decisions that continue to 
emphasize the importance of risk management in the decision-making process. 

The concept of risk management emphasizes strategic decision making with a 
tendency to focus on proactive strategies that relate to prevention, protection and hazard 
mitigation activities within the homeland security context. FEMA defines hazard 
mitigation as “any sustained action taken to reduce or eliminate the long-term risk to 
human life and property from hazards.” (Federal Emergency Management Agency 
(FEMA), 2007 p. 3). This definition is similar to the definition of risk management. Risk 
analysis and mitigation/prevention activities within the context of emergency 
management and homeland security programs are not afforded the same consideration for 
resources and improvement as preparedness, response, and recovery activities. Although 
this inequity of attention and resources is not new, the importance of evaluating this issue 
increases with our investment of treasure in homeland security programs. A simple 
review of the Target Capabilities List (TCL) shows the disparity between the level of 
attention placed on risk management and protection activities and those of preparedness 
and response activities (United States. Department of Homeland Security, 2007). This 
difference is noteworthy, since state and local government focus their homeland security 
investments towards improving their capability in accordance with the TCL. The 2010 
QHSR also concludes that a shift of program emphasis from response and recovery to 
one of risk management and preparedness is needed in order to achieve the level of 
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resilience sought by the homeland security community (United States. Department of 
Homeland Security, 2010). The benefits of hazard mitigation are most effective when 
they are based on a long-term strategic plan developed through an inclusive process 
before a disaster occurs (Federal Emergency Management Agency (FEMA), 2007 p. 3). 

The research in this thesis will address an identified gap in coordinating the risk 
management function throughout the homeland security enterprise. The analysis will 
identify strengths and weaknesses in implementing a coordinated and comprehensive 
approach to integrated risk management. The ultimate goal of this research is to provide a 
collaborative framework that will provide the necessary support to state and local 
governments in risk management. An improved framework will provide state and local 
government with technical assistance and guidance for risk assessment and management, 
which in turn will support resource allocation for strategic risk management. 

D. RESEARCH METHODOLOGY 

The overarching goal of this thesis research is to identify shortfalls within the 
existing approach to all-hazard risk management within the homeland security enterprise, 
and to identify how additional collaborative efforts can improve the risk management. It 
includes special focus on two sub-issues. The first being how to improve collaboration 
between the intelligence community and risk analysts, and the second being the impact of 
a decentralized strategic approach to risk management on strategic decision making 
within state and local government. 

The research for this thesis includes aspects of both policy analysis and program 
evaluation. This approach fuses a formative program analysis with a multi-goal policy 
analysis to establish the frame for the thesis. These approaches are combined to analyze 
both strengths and shortfalls within three areas germane to the area of research. These 
areas include the existing frameworks for homeland security risk management, 
intelligence analysis done in support of risk assessment, and collaboration and strategic 
planning processes with application to the homeland security enterprise. 

The first phase of research involves a qualitative/fonnative program analysis of 
the existing risk management framework used in the homeland security enterprise in the 
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United States. This identifies both strengths and weaknesses inherent to the homeland 
security risk management framework. The key attributes of several standards and 
guidance documents relevant to the homeland security risk management are compared in 
this analysis. This comparison includes: the Target Capabilities List published by the 
U.S. Department of Homeland Security in 2007, the Emergency Management 
Accreditation Program (EMAP) developed by the National Emergency Management 
Association (NEMA), the Baseline Capabilities for State and Major Urban Area Fusion 
Centers, Critical Infrastructure and Key Resources Protection Capabilities for Fusion 
Centers both published by the U.S. Department of Homeland Security in 2008, and 
FEMA’s state and local hazard mitigation planning guidance. This phase includes 
identification of common themes and recommendations in recent reports and studies 
related to the risk management function within the homeland security discipline. It also 
examines the risk management components of the existing the DHS Risk Management 
Doctrine critical infrastructure protection program and the manner in which they are 
being implemented under the National Infrastructure Protection Plan. This examination 
includes the organization and role of state fusion centers with respect to risk management 
functions for both infrastructure protection and terrorism threats. 

The second phase of research involves a qualitative/comparative program analysis 
of the intelligence cycle and risk management cycle. This analysis explores existing 
processes for collaboration between the intelligence community and risk analysts and 
seeks to identify the benefits and challenges inherent to this collaboration. The focus on 
state and local fusion centers (SLFCs) for this phase of research is important for two 
reasons. The first is based on SLFCs collaborative nature for gathering risk infonnation, 
assessing threats, and communicating risk. The second reason is that SLFCs provide 
direct intelligence and analysis support to agencies with a homeland security mission 
within state and local government. The research conducted for this thesis and discussions 
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with colleagues in both the critical infrastructure program and hazard mitigation 
programs indicate that fusion centers remain focused on terrorism and criminal threats 
related to infrastructure protection. 

The third phase of research entails exploration of the enabling and barrier factors 
to interagency collaboration within the homeland security community. It also identifies 
principles of strategic thought and planning and provides a comparison with those factors 
that enable collaboration. The research in this section focuses on the common traits 
associated with collaborative efforts and effective strategic planning within the homeland 
security enterprise. The analysis seeks to detennine how positive traits and strategic 
planning principles can be applied to a new collaborative model for all hazard risk 
management within the homeland security enterprise. The analysis also seeks to 
understand negative aspects of collaboration and apply management and organizational 
theory to overcome identified barriers for collaboration. 

The final aspect of the proposed methodology includes a multi-goal policy 
analysis to compile the information from the first three phases of research into a summary 
analysis of the risk management policy within the homeland security enterprise. The 
result of the multi-goal policy analysis includes recommendations for improvement and 
the identification of areas for additional research and study. 

E. OVERVIEW OF CHAPTERS 

As outlined in Chapter I, the introductory chapter, the focus of this thesis involves 
exploring ways to improve the risk management within homeland security through 
collaboration and decentralization of the risk management process. It employs a 
comparative program analysis to evaluate the existing risk management framework and 
collaboration between the intelligence and risk management communities. 

Chapter II provides an overview of the homeland security risk management 
framework as it currently exists. The foundation provided in this chapter provides the 
basis for understanding the issues within the existing framework and for comparison for 
the remainder of the thesis. The challenges identified in this chapter provide an 
opportunity to improve the homeland security risk management framework. This second 
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chapter goes on to present a comparison of multiple risk management standards and 
models applicable to the homeland security enterprise. This comparison identifies the 
common themes and differences that exist within the various approaches to risk 
management employed throughout the homeland security enterprise. It also examines the 
concept of comparative risk assessment and its potential application to strategic risk 
management within homeland security. 

Chapter III introduces the topic of intelligence as it relates to the homeland 
security enterprise and establishes the relationship between intelligence and risk 
assessment and management. This chapter provides a comparison of the intelligence 
cycle to the risk management cycle from the recently published DHS Risk Management 
Doctrine and the Carnegie Mellon Risk Ranking Model. The chapter provides a 
discussion on existing collaborative efforts between the intelligence community and risk 
analysis community. It goes on to examine potential mutual benefits of enhanced 
collaboration between intelligence and risk analysts. State and local fusion centers are 
also introduced to the discussion in this chapter. The fusion center discussion goes on to 
suggest that fusion centers can provide a vehicle to improve collaboration between 
intelligence and risk analysts in support of a decentralized strategic risk management 
model driven by state and local governments. In this context, the idea of Intelligence-Led 
Risk Management is introduced as a means to improve collaboration between intelligence 
and risk analysts to improve state and local decision making and strategic risk 
management. 

The focus of Chapter IV involves a discussion on collaboration and strategic 
thought and planning. It begins by establishing that collaboration plays an essential role 
within the homeland security enterprise and more specifically an important role within 
the homeland security risk management process. The discussion progresses to include an 
analysis of factors that enable or stifle interagency collaboration. This discussion is based 
largely on the Inter-Organizational Collaborative Capacity Model developed by Hocevar, 
Jansen and Thomas. The concept of federalism is introduced to the conversation as a 
collaborative structure for government. The discussion on federalism draws comparisons 
with the enabling and barrier factors discussed earlier in the chapter. It goes on to explain 
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how friction between states and the federal government creates barriers to collaboration 
and the underlying reasons discouraging a decentralized approach for strategic risk 
management. The last portion of Chapter IV introduces strategic thought and planning 
concepts to the conversation. These concepts include Appreciative Inquiry, the Cynefin 
Framework, and other principles of strategic planning. These concepts are compared with 
the success and barrier factors from the Inter-Organizational Collaborative Capacity 
Model to identify strategies to enable collaboration and manage the obstacles to further 
strategic risk management. 

F. LITERATURE REVIEW 

1. Risk Management Literature 

A significant volume of literature relating to risk management within the 
emergency management and homeland security fields has been published. This includes 
several general guidance documents published by FEMA on hazard mitigation planning 
and risk analysis, including the DHS Risk Lexicon first published in 2008 and updated in 
2010, and the Risk Management Fundamentals: Homeland Security Risk Management 
Doctrine published in 2011. The common elements of these documents involve hazard or 
threat identification and risk analysis as the fundamental elements of a strategic approach 
to risk management. These various documents also communicate the importance and 
value of considering all hazards and all threats, but they fail to provide details on how to 
assess the wide range of threats, hazards and facilities, and they do not provide direction 
for additional information. The language and terminology among these documents varies 
significantly underlining the lack of coordination among the different organizations 
involved in risk assessment. 

There is a significant amount of academic, government, and trade literature 
related to risk management that spans multiple decades. The literature considered was 
narrowed to focus on risk management related to the evolution of the emergency 
management and homeland security discipline. This range of literary sources relating to 
risk assessment includes the following subgroups: natural hazards, terrorism, biological 
threats or vectors, and technological hazards, which include infrastructure failures. A 
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good number of significant contributions that directly pertain to the primary research 
question were published within the last five years, suggesting this remains an area of 
academic and government interest. 

Several reports published over the last five years provided a foundation for 
exploring the research area summarized in this thesis. These include Review of the 
Department of Homeland Security’s Approach to Risk Analysis published by the National 
Academies in 2010, and two volumes published in 2006: Homeland Security Risk 
Assessment, Volume I: Setting, and Homeland Security Risk Assessment Volume II: 
Methods, Techniques and Tools. These sources were selected because of their relatively 
recent publication dates, and their focus on the issue of risk assessment, which is central 
to the research question. 

A cursory review of these sources supports the general conclusion that the 
assessment of risk from natural hazards is the most evolved due to the foundation of 
high-quality data sets and refined models. A key area for improvement related to this 
aspect of risk assessment within the homeland security enterprise includes support of 
long-term risk management and policy decisions with emphasis on social aspects and 
efforts to support local and regional decision making, and to avoid cascading failures of 
critical infrastructure (Committee to Review the Department of Homeland Security's 
Approach to Risk Analysis, 2010). 

The consensus among all of the sources reviewed to date is that the assessment of 
the risk associated with terrorism is hard to model because of the large variance among 
independent variables. The second order social and economic effects of terrorism have 
been largely overlooked so far in accounting for the risk from terrorism (Committee to 
Review the Department of Homeland Security’s Approach to Risk Analysis, 2010 p. 5). 
All sources also agree with the notion that risk assessment is a complex process that 
requires multiple types of expertise to be effective, and that noncollaborative approaches 
to risk management often leave unacceptable residual risk and do not achieve the desired 
results. 
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The current approach for risk management within the homeland security 
enterprise appears to be driven from the federal level with a primary purpose of allocating 
homeland security funding. The QHSR calls for a national-level homeland security risk 
assessment (United States. Department of Homeland Security, 2010 p. 66). The 
assessment of risk from state and local government—where the majority of exposure 
lies—does not figure significantly into this process. DHS acknowledges this fact and the 
need to include more state and local threat and hazard infonnation in their assessments 
(Committee to Review the Department of Homeland Security's Approach to Risk 
Analysis, 2010 p. 59). A report from the Government Accountability Office (GAO) 
stipulates that the risk analysis model used by DHS includes both empirical risk measures 
and policy judgments in assigning risk values for the allocation of resources, and that the 
limitations of the vulnerability model used in the risk assessment significantly reduce its 
utility (GAO, 2008). The focus on assessing risk associated with terrorist attacks is clear 
throughout the GAO report, but the report also alludes to the fact that other risks should 
be taken into account in analyzing vulnerabilities. A recent white paper published by the 
National Emergency Management Association (NEMA) identifies the three strategic 
themes that include broader collaborative partnerships, total hazard awareness, and full 
spectrum community-to-federal emphasis. These themes present a framework for a 
reexamination of the way in which we assess and analyze risk, and the manner in which 
we prioritize the functions of risk analysis, mitigation/prevention, and preparedness 
(NEMA 2009 p. 2-3). 

One finding in the recently published National Plan Review calls for the 
Department of Homeland Security to develop a risk assessment and management process 
that has utility to all levels of government (DHS FEMA National Plan Review 2010 p. 
43). The need for an enterprise-wide national level risk assessment in order to enable 
risk-informed decision making is further articulated in the Quadrennial Homeland 
Security Review Report (HDS QHSR 2010 p. 66). These findings comport with the 
recommendations in the NEMA white paper and appear to be applicable to all levels of 
government in support of their homeland security roles. 
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Even though there are notable differences between risk management processes 
associated with the wide range of threats and hazards within homeland security, 
exploration of how to incorporate these assessments into a useful tool for decision makers 
at all levels of government is warranted. The application of leading-edge science and 
technology is a major factor that influences the analysis of natural and technological 
hazards, as well as the threat of terrorism throughout homeland security (Government 
Accountability Office (GAO), 2008). This need is described within the Quadrennial 
Homeland Security Review Report, and it could support a nationwide comprehensive all¬ 
hazard intelligence model to drive risk-based decision making at all levels of government 
for all hazards and threats. 

The consensus of literature reviewed on the topic suggests the challenge of 
developing a universal approach to risk management in the homeland security enterprise 
is formidable. One perspective suggests that DHS should establish a Chief Risk Officer 
(CRO) to manage all homeland security risks (U.S. Government Accountability Office, 
2008, p. 7). This approach is similar to the model used by large corporations and 
insurance companies. The other predominant point of view suggests that the complexity 
of homeland security risk management is too great for any one individual or office to 
effectively manage (Committee to Review the Department of Homeland Security's 
Approach to Risk Analysis, 2010. p. 8-14). The competing perspectives suggest the most 
effective approach may lie somewhere in the middle. All of the literature agrees that 
effective risk management requires greater coordination and collaboration. 

2. Intelligence and Fusion Center Literature 

Much has been written about fusion centers and the intelligence analysis function 
within the homeland security environment. The majority of this literature has been 
published since 2004 and does not have the maturity and breadth of other literature 
categories. The importance of the intelligence community and their analysis is an 
important factor in understanding the risk associated with terrorism and to develop an 
effective risk management framework. In the National Intelligence Strategy, the former 
Director of National Intelligence, Dennis Blair, asserted that the United States faces a 
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complex and rapidly shifting security landscape, and that persistence and agile adaptation 
are required to meet these challenges. The goals outlined in the National Intelligence 
Strategy that directly apply to analyzing the risk from terrorism could easily apply to risk 
analysis related to natural and technological hazards (ODNI 2009 pp. 1-5). 

The secretive nature of law enforcement and the intelligence community appear to 
contribute to the challenge of assessing the terrorism threat effectively as part of a 
collaborative all-hazard system for risk assessment and management. This point comes 
through in the discussion on risk assessment capabilities in the Baseline Capabilities for 
State and Major Urban Area Fusion Centers published in 2008 (United States. 
Department of Homeland Security, 2008 p. 7). The human behavior variable and 
emotional social aspect of terrorism also contribute to the challenge of assessing risk, and 
subsequently providing an analytical product to assist policy makers in making critical 
decisions. 

Academic and practical discussions over fusion centers provide more questions 
than answers. Even though the U.S. Department of Homeland Security has published 
guidelines for state fusion centers that provide a description of common capabilities, 
however, in a practical sense the capabilities, structure, function and roles of fusion 
centers differ significantly. Even the primary audience for fusion center products is a 
question for debate. When considering the mainstream view that local law enforcement 
should be intelligence collectors and analysts, and that tactical level intelligence is the 
primary role of fusion centers dissenting opinions are readily available. One such 
example would argue that local law enforcement does not have capacity to gather 
intelligence and analyze the information, but instead state fusion centers should focus on 
taking national intelligence products and brief state and local executives on how they 
apply for the pertinent jurisdiction (Steiner 2009). 

The intelligence analysis process may provide some interesting concepts that 

could apply to a comprehensive all-hazard all-risk management framework. This notion 

is supported with several recent publications. A recent publication by the Homeland 

Security Institute provides several findings and recommendations related to collaboration 

between the intelligence community and the risk analysis community. This report 
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provides a good foundation from which to understand the challenges and opportunities 
for collaboration between risk analysts and the intelligence community. Additionally, 
Henry Willis suggests that the risk analysis community can help improve the intelligence 
process (Willis, 2007). The fusion center process provided in the DHS guidelines 
provides an example that could provide a foundation for a framework to consider (United 
States. Department of Homeland Security, 2008). The importance of human intelligence 
and behavior could offer insights on ways to improve the social aspect of risk assessment 
and management. Even information sharing strategy for the U.S. Intelligence community 
calls for a collaborative transformation that promotes a cultural change from “need to 
know” to one that embraces a mindset of “responsibility to share” (United States Office 
of the Director of National Intelligence, 2008). 

3. Collaboration and Strategic Planning Literature 

A large volume of literature exists on the topic of collaboration and strategic 
planning. To manage the scope of this research project, the literature considered will 
relate to collaboration in government, public and private sector partnerships, and strategic 
planning. Significant research on collaboration in government and with public private 
sector partnerships exists largely due to public demand for more efficient government and 
the evolution of the homeland security enterprise. 

A 2006 publication, “ Building Collaborative Capacity: An Innovative Strategy for 
Homeland Security Preparedness ” by Susan Page Hocevar and Gail Fann Thomas 
provides a strong and relevant starting position to examine how interagency collaboration 
can improve the risk management framework. Their work examines factors within 
homeland security organizations that both foster and deter effective inter-organizational 
collaboration. This work provides a suitable frame for identifying critical factors and 
obstacles for collaboration from which to conduct additional research on how to apply the 
positive factors into an organizational framework and to develop strategies to overcome 
the barriers. 
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Intergovernmental collaboration in the homeland security context takes place 
within the confines of the American system of federalism, which serves as the basis for 
our government. The literature suggests that federalism both enables and inhibits 
collaboration between tiers of government for homeland security. A review of the 
strategies and reports related to risk management and intelligence conveys a theme of the 
need for greater state and local input into the enterprise; however, collaboration remains 
difficult within the federalism context. This is largely due to the on-going struggle for 
power between the states and federal government. The problems of homeland security 
tend to exacerbate this friction as the times of crisis such as the Civil War, the Great 
Depression, and the Terrorist Attacks of 9/11 are shown to centralize more power in the 
federal government (Clovis, 2006). 

The body of literature relating to strategic management fits nicely with the 
literature on collaboration for the purpose of examining ways to improve collaboration 
for strategic risk management within the homeland security community. The literature on 
the Cynefin Framework provides a useful tool to view the strategic challenges with 
homeland security risk management and to provide perspective on how collaboration can 
improve the existing condition. The book, The Art of Quantum Planning: Lessons from 
Quantum Physics for Breakthrough Strategy, Innovation, and Leadership translates well 
to the analytic world of intelligence and risk management. The strategic thought and 
planning literature reviewed for this thesis comports with the literature on collaboration. 
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II. HOMELAND SECURITY RISK MANAGEMENT AND 

ANALYSIS 


This chapter provides an overview and assessment of the Risk Analysis and 
Management structure as it currently exists within the homeland security enterprise. The 
first section within the chapter introduces the concept of risk management as it applies to 
the homeland security enterprise. Section B provides an overview of the risk management 
framework that currently exists within the homeland security enterprise. The tools and 
strategies common to the framework were developed by components within the U.S. 
Department of Homeland Security with the intent that they would be used by the agencies 
of federal, state, local government, and the private sector to manage the myriad of risks 
inherent to the homeland security enterprise. The wide spectrum of risk that must be 
considered within the construct of homeland security make the risk management 
landscape exceptionally complex. 

The third section, Section C, of this chapter explores the significant challenges 
presented by the different risks considered within the homeland security enterprise. 
Understanding these obstacles establishes the frame of reference for the reader to 
understand the argument for establishing a common national framework for homeland 
security risk management presented in Section D. This section provides a comparison of 
several risk management models, and it provides an analysis of the strengths and 
weaknesses of each with the intent of identifying approaches to strengthen the risk 
analysis and management culture among all partner organizations involved in homeland 
security. 

Sections E and F explore the concepts of enterprise risk management and 
comparative risk assessment respectively. These concepts provide some insight into 
possible methods to overcome the obstacles inherent to a common risk management 
framework within the homeland security enterprise. 
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A. RISK ANALYSIS AND MANAGEMENT 

The concept and practice of risk management resides at the center of the 
homeland security discipline. Every aspect of homeland security and emergency 
management programs can be derived from a series of basic problems or questions. These 
include: What hazards or threats exist? What are the undesirable outcomes from the 
occurrence of these events? What are the negative consequences of these outcomes? 
What can be done to avoid or reduce the negative consequences of these events? Within 
this context, every homeland security action, initiative, and program at every level of 
government is a component of an intricate risk management system. The importance of 
risk management to the homeland security enterprise is best summarized in this statement 
from the Quadrennial Homeland Security Review Report: “Ultimately, homeland security 
is about effectively managing risks to the Nation’s security.” (United States. Department 
of Homeland Security, 2010). 

The concept of risk used for discussion in this thesis comes from the 2010 DHS 
Risk Lexicon, where risk is described as, “potential for an unwanted outcome resulting 
from an incident, event, or occurrence, as determined by its likelihood and the associated 
consequences.” (United States. Department of Homeland Security (DHS), 2010 p. 27). 
The conceptual framework employed by DHS for risk analysis describes risk as a 
function of threat or hazard ( T/H), probability (P), and consequence (C) or 
R=((T/H)(P)(C)) (Committee to Review the Department of Homeland Security's 
Approach to Risk Analysis, 2010 p. 2). It is important to remember the importance of 
time as a frame as we consider risk management, as it significantly influences our 
perception of threat or hazard and probability of occurrence. People and organizations 
tend to base risk management decisions on both empirical data and emotion. Most people 
and organizations have difficulty with understanding numbers, consequently they often 
perceive the probability of risk based on their ability to readily recall similar events for 
comparison and perception of risk compared to value gained (Ropeik, 2010). 
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Several variations of a definition for risk management exist within the homeland 
security framework. The Department of Homeland Security’s DHS Risk Lexicon defines 
risk management as, “the process of identifying, analyzing, assessing, and 
communicating risk and accepting, avoiding, transferring or controlling it to an 
acceptable level considering associated costs and benefits of any actions taken.” (United 
States. Department of Homeland Security (DHS), 2010 p. 30). The Baseline Capabilities 
for State and Major Urban Area Fusion Centers describes risk management as, “Risk 
management is a continual process or cycle in which risks are identified, measured, and 
evaluated; countenneasures are then designed, implemented, and monitored to see how 
they perform, with a continual feedback loop for decision-maker input to improve 
countermeasures and consider tradeoffs between risk acceptance and avoidance.” (United 
States. Department of Homeland Security, 2008 p. 53). The Target Capabilities List, 
another publication from the U.S. Department of Homeland Security, uses a definition for 
risk management provided by the Government Accountability Office (GAO), “A 
continuous process of managing—through a series of mitigating actions that penneate an 
entity’s activities—the likelihood of an adverse event and its negative impact.”(United 
States. Department of Homeland Security, 2007 p. 43). 

While similarities exist among these examples, the differences point out that risk 
management is a complex issue that remains difficult to coordinate across the enterprise. 
Ideally, a single definition would assist with coordinating efforts. The scope of risk 
analysis within the homeland security enterprise is expansive requiring a wide range of 
subject matter expertise and many different approaches and models tailored to a specific 
application. Risk analysis is the, “systematic examination of the components and 
characteristics of risk” (United States. Department of Homeland Security (DHS), 2010 
pp. 27-28). This analytical process defines risk components, so that they can be 
understood and subsequently managed. In some cases, elements and organizations within 
the U.S. Department of Homeland Security are entirely responsible for risk analysis and 
management. However, this is not the case for the majority of risks associated with the 
homeland security enterprise. For the majority of homeland security risks, the 
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responsibility for analysis and management is spread among multiple organizations at all 
tiers of government and the private sector (United States Department of Homeland 
Security (DHS), 2011). 

The challenges for coordinating risk analysis and management extend beyond the 
differences among the missions and focus of various agencies to include the needs for 
strategic, operational, and tactical decision making within these agencies. A report from 
the Homeland Security Institute identifies these tiers as mission-based system definition, 
system-based risk assessment, and risk informed decision making (Cummings, 
McGarvey, & Vinch, 2006). The nuances of these tiers will be described in the next 
section that describes the nature of the existing homeland security risk assessment and 
management framework. 

B. THE HOMELAND SECURITY RISK ANALYSIS AND MANAGEMENT 

FRAMEWORK 

No single unified risk analysis framework exists within the homeland security 
enterprise. The underlying reason for this reality is that the risks within the homeland 
security domain are too numerous and multi-dimensional with their own unique attributes 
(Cummings, McGarvey, & Vinch, 2006). Some risk management experts from both 
public and private sector organizations believe DHS should construct a single integrated 
approach to risk analysis and management (Government Accountability Office (GAO), 
2008). However, the diversity of risks, multiple risk analysis models, and different 
missions create a formidable challenge that demands strong collaboration. The 2006 
report from the Homeland Security Institute supports this conclusion with findings that 
risk analysis within the homeland security environment is exceptionally complex, 
requiring significant diversity of expertise, and that noncollaborative processes can lead 
to an unbalanced approach to risk management, which can produce unacceptable residual 
risk and risk shifting without increasing security Cummings, (McGarvey, & Vinch, 
2006). This problem forces us to consider, how to combine these elements into a single 
approach that has utility at each level of government and the private sector? 
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The volume and diversity of threats and hazards considered within the homeland 
security risk management framework present several inequities and challenges that are 
important for understanding the problems associated with analysis. While the risk 
analysis responsibilities for U.S. Department of Homeland Security include natural 
hazards, terrorism, public health threats, and infrastructure failure, these efforts are 
substantially weighted to focus on terrorism risk analysis (Committee to Review the 
Department of Homeland Security's Approach to Risk Analysis, 2010). It remains unclear 
if this bias results from public reaction to terrorism acts and political pressure, or if it is 
the result of a more thorough understanding and sophistication of modeling risks 
associated with natural hazards and threats to public health. The asymmetric nature of 
terrorism increases the level of uncertainty. Terrorism also represents a catastrophic risk 
as opposed to a chronic risk like flooding, and the graphic media coverage following 
attacks making it an easy risk to recall from our memory (Ropeik, 2010 pp. 105-114). 
These factors influence emotional responses to risk that can override empirical based 
judgments, thus, increasing the perceived risk from terrorism (Ropeik, 2010). The 
emphasis on terrorism risk analysis and management can also be seen in the allocation of 
homeland security funding. Population density, economic index, and threat assessment 
clustered in urban areas provide the basis for “risk” in the distribution of homeland 
security funds (Government Accountability Office (GAO), 2008b). 

The assessment of risk from natural hazards is the most evolved due to the 
foundation of high-quality data sets and refined models. This component of risk analysis 
also benefits from long-term inter-agency coordination and collaboration in 
understanding and modeling natural hazard risk, which is evident in reviewing the 
various models, reports, and state and local hazard mitigation plans that routinely cite 
input and expertise from the Federal Emergency Management Agency (FEMA), U.S. 
Army Corps of Engineers (USAGE), the National Weather Service (NWS), U.S. 
Geological Survey (USGS), and many other relevant organizations. Since the 
implementation of the Disaster Mitigation Act (DMA) of 2000, state and local 
governments have made significant improvements to their natural hazard risk 
assessments and management strategies. It is important to note that this hazard mitigation 
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planning effort often does not include terrorism or man-made hazards. This can be seen 
in a 2009 analysis of state hazard mitigation plans that examined 30 plans for costal 
states, which are also those with the greatest populations. This analysis shows that only 
50% of the plans reviewed address man-made hazards that include terrorism (Berke, P, 
Smith, G, and Lyles, W, 2009). 

Even with the sophistication of the risk analysis associated with natural hazards, 
significant improvement is needed to support long-term risk management and policy 
decisions with emphasis in three specific areas. The areas requiring significant 
improvement include developing a better understanding of the social aspects of risk, 
efforts to support local and regional risk-based decision making, and understanding 
infrastructure independencies as to avoid cascading failures (Committee to Review the 
Department of Homeland Security's Approach to Risk Analysis, 2010). This deficiency in 
the collective understanding of the social aspects and cascading interdependencies among 
complex networks is a challenge that transcends both terrorism and natural hazard risk 
assessment programs throughout the homeland security domain. 

The risk associated with terrorism remains hard to model because of the large 
inconsistency among independent variables. Data limitations make it nearly impossible to 
characterize threats and consequences, and the second order social and economic effects 
of terrorism have been largely overlooked so far in accounting for the risk from terrorism 
(Committee to Review the Department of Homeland Security's Approach to Risk 
Analysis, 2010 pp. 46-51). Another significant consideration in analyzing the risk 
associated with terrorism is that threat, vulnerability, and consequence are interdependent 
variables instead of independent variables, which significantly increases the difficulty in 
drawing conclusions from the analysis (Cox Jr., Louis Anthony (Tony), 2008). This 
concept can be illustrated with an intelligent adversary with any number of motivations 
that is able to change targets and adapt tactics based on experience and observation of 
countenneasures. The reality of these challenges forces the Department of Homeland 
Security (DHS) and other entities involved in the homeland security enterprise to rely on 
expert judgment, which is difficult to reproduce and is very subjective, for terrorism risk 
analysis. DHS recognizes that risk assessment for terrorism is a complex process that 
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requires multiple types of expertise to be effective, and that noncollaborative approaches 
to risk management often leave unacceptable residual risk (Committee to Review the 
Department of Homeland Security's Approach to Risk Analysis, 2010). 

Three broad approaches to conducting terrorism risk assessment can be identified, 
with each method offering strengths and shortfalls: expert opinions, simulations, and 
historical data analysis (Committee to Review the Department of Homeland Security's 
Approach to Risk Analysis, 2010 p. 49). Expert opinion provides a rapid qualitative 
assessment from a variety of technical experts and intelligence analysts. It also offers an 
analysis where empirical data cannot be obtained due to technical, technological, 
resource, or ethical limitations; however, it does not provide a substitute for data 
collection and analysis (Cummings, McGarvey, & Vinch, 2006b). Another notable 
shortfall of expert opinion is the potential for individual or organizational bias, and 
limitations of expert knowledge. Simulations include a wide range of methodologies to 
include physical, analytical, and engineering simulations. These include computer 
models, fault trees, red teaming, and game theory approaches, to name a few. While 
simulations provide a more structured and empirical approach to risk assessment, they 
require significant amounts of high quality data, time, and technical expertise to produce 
results, and may be limited by available technology. The collection and analysis of 
historical data also provides an avenue for evaluating terrorism targeting and 
methodologies. However, it is generally limited by sparse data sets and the past events for 
which data is available are situation specific, and so it is difficult to draw any general risk 
conclusions with any degree of validity (Committee to Review the Department of 
Homeland Security's Approach to Risk Analysis, 2010 p. 50). 

The vulnerability and consequence analysis components of terrorism risk 
assessment also present significant challenges. Both vulnerability and consequence 
analysis tend to rely heavily on expert opinion and judgment. The vulnerability analysis 
component of risk analysis in the homeland security environment tends to be focused 
heavily on physical security (Committee to Review the Department of Homeland 
Security's Approach to Risk Analysis, 2010 p. 51) . This emphasis in one area can lead to 
errors of omission where other vulnerabilities are not identified, leaving some risks 
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unaccounted for. Consequence analysis related to terrorism risk also proves difficult 
because the intangible and secondary effects are hard to quantify. In some cases, 
secondary effects, such as long-term economic impact, business interruption, 
psychological and societal impacts are not always adequately modeled; however, the 
consequences can be magnified as a result of terrorism events (Committee to Review the 
Department of Homeland Security's Approach to Risk Analysis, 2010 p.51). 

The existing homeland security risk analysis and management landscape is 
complex involving many different risk assessment models to support tactical, operational 
and strategic decision making across a multitude of missions. This complex framework is 
described as having three tiers that include; mission-based system definition, system- 
based risk assessment, and risk infonned decision making (Cummings, McGarvey, & 
Vinch, 2006a). Tier I is Mission-Based System Definition, defines the scope through 
objectives and system boundaries. This tier focuses on assessing threats and risks to 
systems and relating these assessments to mission and security/protection goals and 
objectives. These assessments often involve scenario based assessments, which aid in 
tactical decision making and provide input to the next level of assessment. Tier II is 
System-Based Risk Assessment, which includes the identification and analysis of threats, 
vulnerabilities, and consequences. This tier advances the assessment beyond the risk and 
vulnerabilities to the component parts and begins to account for second and third order 
impacts to larger systems. And Tier III is Risk Informed Decision Making, in which 
policy makers and senior executives make decisions based on information from Tiers I 
and II (Cummings, McGarvey, & Vinch, 2006a). 

Risk communication is another significant component of the three tier model 
because it transcends all three tiers in the framework enabling discourse among multiple 
disciplines and organizations involved at each level. The discourse associated with risk 
communication is important because stakeholder organizations have different perceptions 
of risk and tolerance levels (Cummings, McGarvey, & Vinch, 2006a). This three tiered 
organizational framework provides a methodical approach to scope, assess, and 
communicate risk so that it can be factored into decision making at each tier of 
government. The twenty-five methods, techniques, and tools for risk assessment 
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described and analyzed in Volume II of the Homeland Security Institute report are 
focused on terrorism and infrastructure protection, which is reflected in Cummings, 
McGarvey, and Vinch’s discussion of the three tiered model. The three tiered risk 
assessment model provides a useful frame to consider the dynamics and relationships 
intrinsic to risk analysis and management within the homeland security enterprise. The 
exchange of information and discourse supported by risk communication highlight the 
opportunity for greater collaboration. The differences between the various risks, 
assessment models/strategies, and missions within the enterprise present significant 
challenges to be explored in the next section of this chapter. 

C. CRITICAL CHALLENGES FACING HOMELAND SECURITY RISK 

MANAGEMENT 

Significant challenges present themselves as we consider applying risk 
management principles across the homeland security enterprise. Two reports, one 
published by the Government Accounting Office (GAO) in 2008, Strengthening the Use 
of Risk Management Principles in Homeland Security, and the other published by the 
National Academies, Review of the Department of Homeland Security’s Approach to Risk 
Analysis, capture these significant challenges. Generally speaking, these challenges are 
grouped into political obstacles, failures in strategic thinking, partnership and 
coordination challenges, the lack of a strong understanding of risk management practices, 
and risk communication challenges. 

Given multiple tiers of influence from elected officials, the political challenges 
facing risk assessment and management within the homeland security domain are varied. 
In this context, grants authorized by Congress and delivered to state and local 
government through the Department of Homeland Security (DHS) provide the greatest 
leverage over state and local government (Masse, T, Rollins, J, & O’Neil, S, 2007). This 
leverage is viewed as an important tool to secure the cooperation of state and local 
government in achieving federally driven goals and objectives. The President’s National 
Strategy for Homeland Security suggests an emphasis on risk assessment to meet 
homeland security goals (Buschmann, 2002). This implies the importance of risk 
assessment in setting and achieving national level homeland security goals. The desire of 
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politicians to deliver goods and services to their constituents in the form of earmarks and 
special projects, often works against projects that provide long-tenn trade-offs and 
changes in risk perception over time (Government Accountability Office (GAO), 2008a). 
This manifests in a reluctance to incur up-front risk management costs in return for a 
reduction in risk that may not be fully realized until some years later. Additionally, public 
perception of a risk is heightened following a significant occurrence, which also provides 
political incentive to take action that the public views as having immediate impact on the 
risk. This phenomenon is related to a number of factors, such as ease of recall, control, 
uncertainty, and fairness among others that influence the emotional aspect of risk 
perception (Ropeik, 2010). These significant challenges of viewing risk strategically will 
require time and the attention from leadership to resolve. To accomplish this, DHS needs 
to look beyond the assessment of risk to the integration or risk into the establishment of 
goals and objectives associated with programmatic and budget cycles (Jenkins, 2007). 

The lack of strategic thought related to risk management within the homeland 
security discipline goes beyond program and budget cycles. The absence of public 
discourse on homeland security risks significantly contributes to the shortfalls in strategic 
thought. The dialog on risk management should include all stakeholders, which include 
the public, private sector, federal agencies, and state, local, and tribal governments. This 
discourse is important to evaluate the trade-off decisions expected of political and 
executive leadership. Nontechnical considerations derived from public discourse can 
balance technical assessments and limit the effectiveness of technical assessments if not 
accounted for (Committee to Review the Department of Homeland Security's Approach 
to Risk Analysis, 2010 p. 23). The unique responsibilities of government emphasize the 
downside of risk mitigation, preparedness, response and recovery, but each challenge can 
also provide a business opportunity to the private sector to design technology and 
measures to improve resiliency (Government Accountability Office (GAO), 2008a). Risk 
management must also balance a wide array of risks ranging from terrorism to natural 
hazards, and infrastructure failure across the homeland security enterprise. The diversity 
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of risk perception among the various homeland security stakeholders emphasizes the 
need for discourse and a symbiotic partnership between government and the private 
sector. 

Perhaps the most important group of risk management challenges for homeland 
security relate to coordination and partnerships. The totality of homeland security risks 
need to be viewed as an amalgamation of private and public sector issues in lieu of being 
seen as only a government centric problem (Government Accountability Office (GAO), 
2008a). The lack of intergovernmental partnerships and public private sector partnerships 
for risk management remains a challenge that was also identified in the 
Recommendations for a National Mitigation Effort, published by NEMA in 2009. Risk 
management efforts within the federal government, and even within the Department of 
Homeland Security, remain largely fragmented (Jenkins, 2007). Although DHS recently 
published a homeland security risk management doctrine, current risk management 
guidance remains insufficient. This is largely due to the fact there is great disparity 
among agencies at all levels of government with respect to maturity, understanding, and 
application of risk management concepts and principles (Government Accountability 
Office (GAO), 2008a). Finally, even with acknowledging the existence of the DHS 
Office of Risk Management and Analysis, all of the reports reviewed agree that 
coordination is handicapped due to the absence of a single point of contact, such as a risk 
management officer or office to coordinate risk management efforts throughout the 
homeland security discipline. Although the reports agree on this point, they differ on how 
best to address this issue. The implementation of the principle of “transparency” as 
described in the homeland security risk management remains important to improving 
collaboration and partnerships for risk management. 

The challenge of educating homeland security stakeholders in risk management 
concepts and principles must be overcome to facilitate greater collaboration and 
partnerships, overcome political obstacles, and improve strategic thinking. The separation 
and analysis differences between the risk management and intelligence functions within 
the homeland security enterprise significantly contribute to the shortfalls in collaboration 
between these disciplines. Intelligence analysis often supports the larger risk management 
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mission, but there is a general lack of appreciation for rationales, responsibilities, and 
methodologies of risk assessment within the intelligence community (Government 
Accountability Office (GAO), 2008a). Although the processes and focus between the 
intelligence and risk analysis community disciplines may differ, both offer analysis 
important to the risk management process. Training intelligence analysts in the risk 
analysis and management concepts and principles could help improve coordination and 
collaboration between these disciplines. The federal government has fallen short on 
educating state and local government in risk management concepts and principles as they 
relate to homeland security (Government Accountability Office (GAO), 2008a). This 
oversight creates significant problems, since the federal government asks state and local 
governments to spend money in accordance with national priorities and initiatives. The 
Department of Homeland Security recognizes this shortfall, and seeks to incorporate 
more state and local input into risk analysis and risk management decisions (Committee 
to Review the Department of Homeland Security's Approach to Risk Analysis, 2010 p. 
59). Improvement to risk management education among all stakeholders in the homeland 
security enterprise is a critical aspect of enabling the “unity of effort” identified as a key 
principle in the homeland security doctrine. 

The complications related to homeland security risk communication are largely 
the sum of the obstacles from the other groupings. Although DHS published the DHS 
Risk Lexicon in 2007 with an update in 2010, the document is not widely known or used 
by all partners in the homeland security risk management community. When I shared the 
document with the State Hazard Mitigation Officers over our infonnal collaboration 
network, the vast majority had never seen the document, and communicated that their 
agencies were not using the document. I encountered similar results when I shared the 
document with the public health community within the State of Idaho. The overt focus on 
unlikely risks with dramatic consequences creates a condition where public fear 
undennines efforts to engage in a fact-based analysis of risk (Government Accountability 
Office (GAO), 2008a). All of the reports reviewed also agree that the limited 
consideration of behavioral impacts present a significant shortfall in risk analysis and 
management efforts. The improvement of behavioral, psychological, and sociological 
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aspects of risk emerges as a key theme from the report, Review of the Department of 
Homeland Security’s Approach to Risk Analysis (Committee to Review the Department 
of Homeland Security's Approach to Risk Analysis, 2010). 

Examination of existing risk analysis and management practices within the 
homeland security enterprise reveals several efforts to encourage collaboration and 
produce a common strategic vision for risk management; however, the shortfalls 
overshadow these efforts. Effective collaboration for the management of homeland 
security risk requires leadership, guidance, and the involvement of all stakeholders. The 
next section explores the need for this common framework. 

D. NEEDED: A COMMON NATIONAL FRAMEWORK FOR HOMELAND 

SECURITY RISK MANAGEMENT 

Since the creation of the Department of Homeland Security in 2002, multiple 
organizations, reports, and studies have called for a coordinated national strategy for 
homeland security risk management. FEMA’s 2006 Nationwide Plan Review: A Report 
to Congress identified a need for national guidance on catastrophic risk analysis. A white 
paper published by the National Emergency Management Association (NEMA) in 2009 
called for the development of an effective national mitigation effort, and to accomplish 
this, it identifies the three strategic themes that include broader collaborative 
partnerships, total hazard awareness, and full spectrum community-to-federal emphasis 
(National Emergency Management Association, 2009). These themes present a 
framework for a reexamination of the way in which we assess and analyze risk, and the 
manner in which we prioritize the functions of risk analysis, mitigation/prevention, and 
preparedness. The 2010 Nationwide Plan Review identifies the need for a risk assessment 
and management process usable by all levels of government (Federal Emergency 
Management Agency (FEMA), 2010). Additionally, the Quadrennial Homeland Security 
Review Report emphasizes the need to collaboratively analyze homeland security risks in 
order to manage them effectively at every level of government and the private sector 
(Committee to Review the Department of Homeland Security's Approach to Risk 
Analysis, 2010). 
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The need for a more effective and standardized national approach for homeland 
security risk analysis and management is clear, and supported at each level of 
government. This leaves us with the question, what has been done thus far to develop 
national risk analysis and management process ? The Department of Homeland Security 
created the DHS Risk Lexicon in 2008 to establish a common vocabulary for risk analysis 
and management across the homeland security enterprise. A revised version of this 
document was released in September 2010. The National Mitigation Alliance was created 
in 2011 to foster a collaborative process to reach across disciplines and levels of 
government to promote a comprehensive national mitigation framework. The National 
Mitigation Alliance is the product of a cooperative agreement between FEMA and the 
National Emergency Management Association to implement the vision outlined in the 
NEMA white paper. The alliance provides a collaborative model that addresses risk 
management through strategic themes to include total hazard awareness and full- 
spectrum community-to-federal emphasis (National Emergency Management 
Association, 2009). Additionally, DHS published Risk Management Fundamentals: 
Homeland Security Risk Management Doctrine in April of 2011. This document is 
intended to serve as, “an authoritative statement regarding the principles and process of 
homeland security risk management and what they mean to homeland security planning 
and execution” (United States Department of Homeland Security (DHS), 2011). 
Although not the complete solution, this document provides an important piece in 
creating a culture of risk management within the homeland security environment. 

State and local governments need to play a larger and more active role in 
homeland security risk management. DHS acknowledges the need to include more state 
and local input into its risk assessments (Committee to Review the Department of 
Homeland Security's Approach to Risk Analysis, 2010 p. 59). Evidence of this realization 
can be seen in the Emergency Management Performance Grant (EMPG) and Homeland 
Security Grant Program (HSGP) Guidance documents for federal fiscal year 2011. Both 
of these documents list objectives for states to develop Threat and Hazard Identification 
and Risk Assessments (THIRA) to include the entire range of threats and hazards faced 
by the respective jurisdictions. The guidance goes on to communicate the importance of 
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including terrorism and other man-caused hazards into the state hazard mitigation plans 
that have been developed by the states. As of the publication of this paper, no specific 
guidance or job aids have been issued to state and local governments on a standard 
methodology for developing a THIRA. 

Multiple risk management models and standards exist within the homeland 
security enterprise. The following chart provides a comparison of risk management 
guidelines from several documents familiar to the emergency management and homeland 
security communities. These documents provide recognized industry standards and 
common capabilities. The documents compared include the DHS Target Capabilities List, 
National Fire Protection Association Standard 1600 (All-Hazards Emergency 
Management/Homeland Security), Emergency Management Accreditation Program 
(EMAP), FEMA Guidelines for State and Local Hazard Mitigation Plans, and DHS State 
and Major Urban Area Fusion Center Capabilities. Examination of the similarities and 
differences between these documents can help us improve coordination among agencies 
to improve risk management throughout the enterprise. 
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Table 1. 


Comparison of Guidelines and Standards with Risk Analysis and Risk 
Management Attributes 


Comparison of Guidelines and Sta 
Management Attributes Within 1 

ndards With Risk Analysis and Risk 
the Homeland Security Framework 

Emergency Management / Homeland Security Guidance and 

Standards 


Risk Management Attributes 

Develop a Risk 
Management 
Framework 

Assess Risks 

Prioritize Risks 

Develop a Business 
Case 

Manage Risks 

Risk Communication 

Includes Intelligence 

Target Capabilities List (2007) 

X 

X 

X 

X 

X 

X 

X 

National Fire Protection 

Association Standard 1600 


X 

X 

X 

X 



Emergency Management 

Accreditation Program (EMAP) 


X 

X 

X 

X 

X 


FEMA Guidance for State and 
Local All-Hazard Mitigation Plans 


X 

X 

X 

X 

X 


Baseline Capabilities for State and 
Major Urban Area Fusion Centers 


X 




X 

X 

Fusion Centers Critical 

Infrastructure / Key Resources 
Protection Capabilities 

X 

X 




X 

X 


Examination of the various guidance and standard documents and their associated 
attributes compared in Table 1 provides insight into the strengths of homeland security 
risk management. The assessment and communication of risk are the most common 
attributes between the various documents compared. These two common elements 
provide an opportunity to open a dialog and draw the terrorism centric homeland security 
risk assessment/management community and the natural hazards centric emergency 
management risk assessment/management community closer together. 

Analysis of the various guidance and standard documents and their associated 
attributes in Table 1 also identifies key differences that can be viewed as shortfalls in 
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some of the approaches reviewed. The three emergency management focused standards 
do not include intelligence as an attribute. This is likely due to the fact that the inclusion 
of man-made hazards, which include terrorism, are not encouraged in state and local 
hazard mitigation plans (Federal Emergency Management Agency (FEMA), 2007 p. 59). 
The two fusion center capability documents do not include attributes associated with the 
prioritization of risks, development of a business case, or the management of risk. This 
could be due to the challenges with assigning probabilities and empirical models to the 
asymmetric threat of terrorism or the separation of intelligence and risk analysis within 
the homeland security enterprise. The inclusion of risk prioritization, business case 
development, and risk management in the emergency management centric standards is 
likely due to the experience with natural hazard mitigation planning. Integrating the 
natural hazards program experience with building business cases and prioritizing risks 
could advance efforts to implement a comprehensive approach to risk management 
within the homeland security enterprise as recommended by the GAO (Jenkins, 2007). 

E. ENTERPRISE RISK MANAGEMENT 

This section discusses enterprise risk management and compares several risk 
management models. The concepts of enterprise risk management and integrated risk 
management are closely related in the homeland security context. Enterprise risk 
management is defined as a, “comprehensive approach to risk management that engages 
organizational systems and processes together to improve the quality of decision making 
for managing risks that may hinder an organization’s ability to achieve its objectives” and 
integrated risk management is defined as a “structured approach that enables the 
distribution and employment of shared risk infonnation and analysis and the 
synchronization of independent yet complementary risk management strategies to unify 
efforts across the enterprise” (United States. Department of Homeland Security (DHS), 
2010 pp. 12-13, 19). Both concepts emphasize the importance of sharing information to 
synchronize independent systems and organizations for effective risk management across 
the enterprise. 

The DHS Risk Management Doctrine incorporates both of these concepts into the 

national vision for homeland security risk analysis and management (United States 

33 



Department of Homeland Security (DHS), 2011). Further evidence of the commitment to 
an enterprise risk management system comes from the DHS Policy for Integrated Risk 
Management signed by Secretary Napolitano in 2010. The policy stipulates achieving 
integrated risk management by incorporating the risk management process into the 
overall mission of DHS encompassing all subcomponent organizations, using risk 
information to achieve greater degrees of transparency and risk-informed decision 
making, and using a unified approach to manage risks with all partners involved in the 
homeland security venture (Kolasky, 2011). 

The International Organization for Standardization (ISO) recently published ISO 
31000:2009 Risk Management Principles and Guidelines as a standard that would apply 
internationally to all forms of risk. The diversity of risk, complex challenges, and need 
for system adaptability to address contextual issues and emerging risk required for the 
ISO 3100:2009 standard directly compare with those issues faced by enterprise risk 
management within the homeland security discipline. Not surprisingly, many similarities 
exist between the ISO 3100:2009 standard, the approach laid out by the U.S. Department 
of Homeland Security. Several key differences in these models are also noteworthy. This 
standard has received the attention of the emergency management and homeland security 
community as a significant advance in emergency management concept for the 
comprehensive management of disaster risk at the community level (Jones, 2011 (May)). 

The expansive scopes of the ISO risk management standard and the risk 
management approach within the homeland security enterprise both require a common 
vocabulary to transport information and concepts across different domains. The 
homeland security model includes the DHS Risk Lexicon for this purpose while the ISO 
31000:2009 standard provides tenns and definitions in clause 2 and makes reference to a 
glossary of risk management terms, ISO Guide 73:200. The importance of clearly defined 
common terminology cannot be overlooked when working with the wide range of partner 
organizations working towards the common goals of resiliency and security, as we have 
in the homeland security enterprise. The homeland security community should avoid the 
shortfalls from the ISO 31000 approach to a common vocabulary. These shortfalls 
include ambiguous definitions that often use words that express generalities in lieu of 
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specifics, a general avoidance of mathematical words, and the assignment of new 
interpretations to tenns already widely used and accepted within the risk community 
(Leitch, 2010). The DHS Risk Lexicon avoids this pitfall so far; however, future 
iterations will also need to include the same precision with definitions. 

Performance measurement provides another common thread between the ISO 
standard and the homeland security system for risk management. The ISO standard 
provides a more general discussion of performance criteria; however it does identify 
several key principals that easily apply within the homeland security context. These 
guiding principles for risk management include: 1. Effort should create and protect value, 
2. Be a significant part of decision making, 3. Explicitly address uncertainty, 4. Include a 
systematic, structured and timely process, 5. Be based on the best available information, 
6. Be tailored to the specific context, and 7. Facilitate continual improvement to the 
organization (Purdy, 2010). The guidance offered by DHS is also general in nature, 
although it does provide more detail in methodologies. It includes the use of logic models 
that incorporate goals, inputs, efforts, outputs, and outcome performance measures. 

The homeland security model also emphasizes the role of red teaming (scenario 
role-playing), exercises, surveys, and unbiased external review. DHS describes the best 
measure for risk management performance as either the continued appropriateness of risk 
acceptance or the reduction of the likelihood or consequences of a risk (United States 
Department of Homeland Security (DHS), 2011). This supports the concept strategic 
planning through scenarios as described by Van der Heijden in the book, Scenarios. 

One curious omission from the discussion on perfonnance measurement in both 
approaches is the role of the cost-benefit analysis modeling and subsequent loss 
avoidance studies. Both cost-benefit analysis models and loss avoidance studies figure 
prominently into the FEMA risk management programs for natural hazards. A cost- 
benefit analysis is an important factor in making a business case, which is identified as an 
important attribute in most of the guidance and standards documents reviewed (Federal 
Emergency Management Agency (FEMA), 2003). 
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A clearly defined process lies at the heart of all risk management systems, and 
neither of the DHS or ISO approaches are an exception to this rule. Each of their 
respective risk management processes, shown in Figures 1 and 2, contain some common 
elements that include establishing a context, identification and analysis of risk, 
communication, and the evaluation and monitoring feedback loop. The DHS process 
model shown in Figure 1 includes the development of alternatives and decision and 
implementation. These steps or an equivalent are conspicuously missing from the ISO 
model shown in Figure 2. The ISO standard emphasizes the importance of including the 
risk management process in decision making, but it neglects to include the decision¬ 
making steps in the process model. This noteworthy omission from the ISO model 
should caution state and local emergency management organizations from adopting the 
ISO model at face value without evaluating other models. The development of 
alternatives and decision/implementation steps are critical for engaging leadership in a 
discourse to consider all viable risk management strategies for emergency management 
and homeland security risk management issues. 



Figure 1. DHS Risk Management Process from (United States Department of 

Homeland Security (DHS), 2011 p. 15) 
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Figure 2. ISO Risk Management Process from (Purdy, 2010) 

Both the ISO and DHS risk management models agree that the risk management 
process should be incorporated into the organizational decision-making process. Both 
models also agree that the concepts within their respective risk management process 
models should be tailored to address the situation and perspectives of the organizations 
applying them. The importance of scalability and adaptability with these process models 
in the homeland security context is evident considering that an enterprise wide model 
must work for multiple tiers of government agencies with different missions, the private 
sector, and nonprofit volunteer organizations. 

Another risk management model important to the homeland enterprise is the Risk 
Management Framework located within the National Infrastructure Protection Plan 
(NIPP) published in 2009, which is depicted in Figure 3. The 2009 update to the NIPP 
includes greater emphasis on risk management and resilience. This includes significant 
updates to risk methodologies and information sharing systems ( Critical Infrastructure 
Protection Update to National Infrastructure Protection Plan Includes Increased Emphasis on 
Risk Management and Resilience. 2010). A comparison of the NIPP Risk Management 
Framework to the common elements of the DHS and ISO risk management models 

reveals some awkward connection in terms of vernacular and process. The first two steps 
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of the NIPP framework include setting goals and objectives and identifying assets, 
systems and networks. These steps are similar to the step for establishing context in the 
DHS and ISO models. The NIPP does not include an evaluation of alternatives unless this 
is included in the prioritization step, while this is built into the DHS model. 



Figure 3. National Infrastructure Protection Plan Risk Management from 
(National Infrastructure Protection Plan. 2009 ) 

The greatest drawback to the NIPP Risk Management Framework is the 
difference in terminology compared to both the DHS risk management model and the 
ISO model. The success of the infrastructure protection program relies heavily on 
partnership with private industry and state and regional fusion centers to collect, analyze 
and share information (. National Infrastructure Protection Plan2009). The private sector 
partners are more likely to use and be more familiar with the ISO model as industry 
standards, which are more similar to the DHS model than the NIPP model. Additionally, 
the use of different models for the same concept within the homeland security enterprise 
makes communication and collaboration more challenging. 

F. COMPARATIVE RISK ANALYSIS 

The concept of comparative risk analysis provides a framework that can be used 
to compare many different risks within the homeland security enterprise. The U.S. 
Environmental Protection Agency pioneered comparative risk ranking with the 
publication of Unfinished Business: A Comparative Assessment of Environmental 
Problems in 1986. This comparative risk analysis process involves categorizing risks and 
identifying key attributes to serve as the basis for comparison (U.S. Environmental 
Protection Agency (USEPA), 1987). This innovative approach to risk ranking allowed 
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experts and lay people to engage in a dialog to collectively rank the risks (Florig, K. H., 
Morgan, M. G., Morgan, K. M., Jenni, K. E., Fischoff, B., Fischbeck, P. S., & DeKay, M. 
L., 2001). The adaptability of the comparative risk assessment approach makes it useful 
for decision making across a wide spectrum of risk issues while allowing for the 
combination of emotional, social, and political issues and facts backed with empirical 
data to support decision making (Power & McCarty, 2006). This innovative approach 
was not without its problems. The key deficiencies with the EPA study conducted in 
1986 relate to the categorization of the risks considered. Confusion over the 
categorization of risks resulted from an inconsistent approach where some environmental 
risks were categorized by source, some were categorized by the physical agent 
responsible for hann, and still others were categorized by accidental or routine 
occurrence (Morgan, Florig, DeKay, & Fischbeck, 2000). 

The Carnegie Mellon Risk Ranking Method consists of five steps as shown in 
Figure 4. It provides the basis for comparative approach to risk assessment. This process 
is described by Florig et al. (Florig, K. H., Morgan, M. G., Morgan, K. M., Jenni, K. E., 
Fischoff, B., Fischbeck, P. S., & DeKay, M L., 2001) and Morgan et al. (Morgan et al., 
2000). The first step involves defining and categorizing the risks to be evaluated and 
ranked. The step identifies which attributes for the risks should consider in the 
comparison. These two steps are most often done together so that the list of categories 
and attributes to be considered evolve together. The risks are then summarized on 
summary sheets or reports for comparison. Next, participants are selected and a 
comparative analysis is performed to produce the risk rankings. Finally, the issues 
associated with the key issues being described to support the final rankings. Value 
judgments and perspective of those involved figure significantly into each step of the 
process. 
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Figure 4. Carnegie Mellon Risk Ranking Method from (Florig, K. H., Morgan, 
M. G., Morgan, K. M., Jenni, K. E., Fischoff, B.,Fischbeck, P. S.,& DeKay, 

M. L., 2001) 


The success of a comparative approach to risk assessment and ranking depends 
largely on how the comparisons are framed for the decision makers and stakeholders 
charged with risk management. The division and categorization of risks provides the 
basis for establishing the frame of comparison, and thus the results of risk ranking 
endeavors are subject to influence from this initial step (Morgan et ah, 2000). Most risk 
ranking efforts have invested too little attention to framing and facilitating the ranking, 
and thus stifling risk communication and discourse among stakeholders (Florig, K. H., 
Morgan, M. G., Morgan, K. M., Jenni, K. E., Fischoff, B., Fischbeck, P. S., & DeKay, M. 
L., 2001). Value judgments also factor significantly into several aspects of comparative 
risk assessment. Obviously, value judgments figure significantly into objective 
comparison of which two hazards or threats are inherently more risky. Additionally, the 
relative importance of attributes and categorization of risks require value judgments that 
ultimately influence the frame of the assessment (Morgan et ah, 2000). 

G. OBSERVATIONS AND CONCLUSIONS 

Numerous standards and ideas about risk management exist among government 
and the private sector alike. The homeland security domain is expansive and requires an 
adaptive framework that can fuse the best of these elements together instead of trying to 
construct a one-size fits all risk assessment and management tool. The risk management 
framework must incorporate both qualitative and quantitative analyses, common 
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terminology and guiding principles, and be able to facilitate and manage discourse among 
many disciplines and stakeholders. Ultimately, it must be a useful tool in supporting 
decision making within local, state, and federal government and the private sector. 

A fully integrated risk analysis approach remains impractical given the wide 
range of unique risks that must be considered within the homeland security discipline. An 
integrated risk analysis model requires risks to be compared in a common metric. The 
quality and availability of data sets available for establishing probability, vulnerability, 
and consequence for each hazard or threat is too diverse to fit within a common metric, 
and the level of uncertainty associated with these variables is not consistent for the 
various hazards and threats (Committee to Review the Department of Homeland 
Security's Approach to Risk Analysis, 2010). The diversity of analysis tools and metrics 
provide additional detail that is beneficial to decision makers (Committee to Review the 
Department of Homeland Security's Approach to Risk Analysis, 2010). An integrated risk 
analysis approach would need to be highly quantitative to be effective, and this would 
limit the benefit that the discourse of qualitative risk analysis adds to discussions and 
decision making. 

Comparative risk assessment and ranking provides an approach that incorporates 
the strengths of both quantitative and qualitative methods of risk assessment to support 
decision making. The selection of risk attributes in the Carnegie Mellon Risk Ranking 
Method allows diverse risks to be compared on an equal footing. DHS should employ a 
comparative risk assessment tool, as it allows multiple metrics to be compared against 
common attributes allowing stakeholders and policy makers to incorporate best judgment 
into the decision-making process (Committee to Review the Department of Homeland 
Security's Approach to Risk Analysis, 2010, p. 87). 

The success of the homeland security enterprise depends largely on accurate and 

coordinated risk analysis and management, and the complexity and need for collaboration 

among a multitude of agencies and disciplines demands effective leadership to coordinate 

these efforts. The lack of a Chief Risk Officer (CRO) is cited as a factor discouraging 

effective leadership and collaboration (Government Accountability Office (GAO), 

2008a). The homeland security CRO would need to work with many agencies and the 
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private sector to develop an understanding of existing and emerging risks to establish a 
risk framework that applies scientific knowledge to assess the frequency, vulnerability, 
and consequence of various risks. They also need to communicate the findings to policy 
makers and the public to steer risk management decisions and policy (Government 
Accountability Office (GAO), 2008a). 

A compelling argument against establishing a chief risk officer within the 
homeland security enterprise exists. The basis for this argument is that there is a need to 
assess risk among many government agencies for a plethora of issues, and each of these 
assessments depends on agency mission, concerns to be addressed, methodology, and 
expertise required. The ability to accumulate the required expertise, develop contextual 
awareness, and maintain proficiency across the entire spectrum of expertise is daunting at 
best and more likely a failure (Committee to Review the Department of Homeland 
Security's Approach to Risk Analysis, 2010). The direct interactions between analysts 
and stakeholders are important and make significant contributions to the qualitative 
analysis and decision making for risk management, and the creation of a CRO within the 
homeland security enterprise would dilute this exchange. This lesson was learned when 
the OMB tried unsuccessfully to construct a single risk analysis tool to be used by ah 
agencies across the government (Committee to Review the Department of Homeland 
Security's Approach to Risk Analysis, 2010). 

The most important revelation from the literature is the development of a strong 
culture for risk management within the homeland security community. While this simply 
stated notion sounds intuitive, it will be a long and difficult process. It will require a more 
thorough understanding of risk tolerance from many perspectives to include ah tiers of 
government, the private sector, and the public, better risk communication practices, 
stronger collaboration and information sharing practices, and greater strategic thought 
(Government Accountability Office (GAO), 2008a). This evolution will require a 
paradigm shift within the homeland security community from one dominated by what we 
traditionally consider to be focused on preparedness and response to one that emphasizes 
the more proactive approaches of protection, prevention, and hazard mitigation. The path 
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to success requires an enterprise wide shift from reacting to past events and anticipating 
future events, so that we can prepare ourselves accordingly (Government Accountability 
Office (GAO), 2008a). 

The DHS Office of Risk Management and Analysis has made steps towards 
establishing a risk management culture within the DHS components. These include the 
publication of the DHS Risk Lexicon, Creation of the Risk Steering Committee, and most 
recently the publication of the DHS Risk Management Doctrine, Risk Management 
Fundamentals. However, recent hiring and training programs do not appear to be 
improving the situation, and other examples of government agencies with a strong risk 
management culture such as the U.S. Environmental Protection Agency (EPA) and the 
Nuclear Regulatory Commission (NRC) took many years to develop this culture 
(Committee to Review the Department of Homeland Security’s Approach to Risk 
Analysis, 2010). DHS faces a more substantial challenge than the EPA or the NRC for 
several reasons. These include the scope and variety of risk across the homeland security 
enterprise, asymmetric threats and intelligent adversaries, and the stakeholder/partner role 
shared by numerous local, state, and federal agencies, industry, nongovernmental 
organizations, and a seemingly endless list of professional disciplines and technical 
experts. 

The Quadrennial Homeland Security Review Report (QHSR) identifies the need 
for a national-level homeland security risk assessment, but it fails to specify and 
emphasize the important role of state and local governments in developing and 
implementing a national approach to risk assessment. The QHSR specifies the need to 
include intelligence assessments and the expertise and information that exists among the 
various federal departments and agencies (United States. Department of Homeland 
Security, 2010). While all of the literature reviewed agrees that a feasible approach for a 
national-level homeland security risk assessment is needed, the systematic and 
meaningful incorporation of state and local risk information in federal level assessments 
remains to be seen (Committee to Review the Department of Homeland Security’s 
Approach to Risk Analysis, 2010). To date, insufficient engagement and participation of 
state and local practitioners and experts in applying risk management concepts to the 
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homeland security enterprise remains a missed opportunity, since significant amount of 
knowledge and ability represent an untapped resource (Government Accountability 
Office (GAO), 2008a). DHS acknowledges the need to incorporate the need to include 
more state and local input into risk assessments, and this is evident with their efforts in 
several outreach programs, however, much work remains to improve coordination 
between DHS and the state and local partners. 

The homeland security risk analysis and management literature agree that a need 
to construct strong risk analysis and management capability within the homeland security 
enterprise exists. A robust risk management culture will need to include a collaborative 
effort among a variety of experts from each tier of government and the private sector. 
Stronger two-way partnerships with academic institutions are needed to improve the 
education and understanding needed to develop the risk management culture within the 
homeland security enterprise (Committee to Review the Department of Homeland 
Security's Approach to Risk Analysis, 2010). 

Although the specifics and level of sophistication among risk analysis and 
management differ greatly among agencies and missions in the homeland security 
enterprise, many challenges remain. It is clear the scope of risk analysis and management 
across the homeland security domain is too vast to be effectively handled by any one 
entity or by the federal government alone. Stronger coordination and collaboration among 
all of the stakeholders across the various missions and disciplines could provide 
significant improvement to all aspects of homeland security risk management at each 
level of government to achieve the results the citizens of the United States deserve and 
expect. 

The important relationship between intelligence and risk assessment may not be 
overlooked, if you are to truly understand the landscape of homeland security risk 
management. The qualitative expert assessments from the intelligence community 
significantly contribute to terrorism risk assessments. The risk analysis community and 
intelligence community can leam much from each other to improve the management of 
risk in the homeland security enterprise. These ideas are explored in the next chapter. 
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III. INTELLIGENCE AND RISK MANAGEMENT 


The intelligence and risk analysis functions each play an important role within the 
homeland security enterprise. While intelligence and risk analysis are not synonymous, 
much in common exists between them. The common ground between these two 
independent concepts is based on a common purpose, which is to allow policy makers to 
make informed decisions. 

A clear understanding of the basic principles of both intelligence and risk 
management provide the basis of comparison between these two independent yet similar 
disciplines. This chapter builds on the previous chapter, which provided an understanding 
of the tenets and issues associated with homeland security risk management by 
introducing the concept of intelligence and describing the similarities and li nk s shared 
with risk management. The discussion includes an examination of the support 
intelligence lends to homeland security risk analysis and a comparison of the intelligence 
and risk management cycles. 

The culmination of the comparison between intelligence and risk analysis and 
management leads to the introduction of Intelligence-Led Risk Management. This 
concept combines the intelligence cycle with risk management and risk management 
principles to support tactical, operational, and strategic level decision making within the 
homeland security mission. It explains how the common ground and differences between 
intelligence and risk analysis can be leveraged to improve risk management within the 
homeland security enterprise. 

This chapter will explore how the common ground and differences between 
intelligence and risk analysis can be leveraged to improve risk management within the 
homeland security enterprise. 

A. WHAT IS INTELLIGENCE? 

In order to understand the commonalities and differences between intelligence 
and risk analysis, we should begin by defining and describing what intelligence is. A 
reasonable definition of intelligence as a working concept for this thesis is borrowed from 
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Mark Lowenthal. He describes intelligence as “the process by which specific types of 
information important to national security are requested, collected, analyzed and provided 
to policy makers; the products of that process, the safeguarding of these processes and 
this information by counterintelligence activities; and the carrying out of operations as 
requested by lawful authorities.” (Lowenthal, 2009). The first part of this definition—the 
collection and analysis of information and the communication of that analysis to decision 
makers—provides our focus for comparing intelligence and risk analysis. The fruits of 
this concept are the intelligence assessments, which provide important information 
regarding targets, capabilities, and intent of adversaries that may execute terrorism 
attacks on the population or infrastructure. On the surface, this information is 
incorporated as one aspect of the comprehensive risk assessment within the homeland 
security purview. 

Understanding that intelligence represents an analytical process provides the basis 
from distinguishing it from just being information. In describing the common 
understanding of the intelligence process, Lowenthal cites a diagram adapted from the 
Central Intelligence Agency’s Consumer’s Handbook to Intelligence provided in Figure 5 
(Lowenthal, 2009). Policy advisors and senior staff detennine what infonnation is needed 
and how best to collect it during the planning and direction phase. The required 
information is then collected according to the direction provided. Next, the raw data is 
processed into a format that can be used by the analysts. During the analysis and 
production step, analysts review the processed data from multiple sources and fuse the 
information into the reports and assessments needed to advise policy makers on any 
number of issues related to national security. These reports and assessments are then 
distributed to the policy makers who need the infonnation, at which point the process 
repeats itself based on requirements for additional infonnation or changing priorities 
(2009 national intelligence: A consumer's guide2009). 
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Figure 5. Intelligence Cycle from (Lowenthal, 2009 p. 65) 

B. INTELLIGENCE AND RISK ANALYSIS: COMMON THREADS 

Information is the currency of both intelligence and risk analysis. Mark 
Lowenthal asserts, “All intelligence is information, not all information is intelligence. ” 
(Lowenthal, 2009). The same could be said about risk analysis in that all risk analyses are 
information, but not all risk information is risk analysis. Simply stated, analysis and 
added value provide the key distinctions between being just information or the product of 
intelligence or risk analysis. With this premise, we can explore the similarities and subtle 
differences between intelligence and risk analysis and determine how the strong points of 
these elements can work in concert to improve risk management within the homeland 
security enterprise. 

Information provides the lifeblood for the production of intelligence and risk 
analysis. However, management of the collection and flow of information within both the 
intelligence cycle and risk management process can present a significant challenge. The 
volume of information readily available through geospatial intelligence, signals 
intelligence, human intelligence, measurement and signals intelligence, and open source 
intelligence provide more data than existing capabilities can analyze. The same holds true 
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for information sources that provide data for risk analysis. Success of intelligence is not 
measured by information collected, but instead by the timeliness, efficiency, and, 
accuracy in supporting decision making (Sims, J. E. & Gerber, B., 2005). The same 
standard can be applied to risk analysis. Public safety and homeland security 
organizations need accurate, relevant, timely, and current intelligence to meet their needs 
for incident mitigation (Townsend et al., 2010). Mark Lowenthal states, “Intelligence is 
not about truth,” and goes on to explain that it is more accurate to think about intelligence 
as proximate reality (Lowenthal, 2009). This point is important for both intelligence and 
risk management. In particular, strategic risk management requires analysts to think 
beyond either/or comparisons and to broaden thought to consider all possibilities, which 
are tenets of strategic planning (Harris, 2009). The analysis of both intelligence and risk 
are geared to provide a factual working understanding of a given situation and plausible 
outcomes based on a number of variable factors. 

Both risk analysis and intelligence support risk informed decision making. In each 
case, policy makers and decision makers require infonnation tailored to their specific 
needs in order to make informed policy decisions to manage risks. Threat-based foreign 
policy, global intelligence interests, and consumer-producer relations are recurring 
themes that shape the U.S. intelligence landscape (Lowenthal, 2009). Intelligence 
provides information about existing and emerging strategic risks and threats to our 
national security and interests across the globe. Decision makers use this intelligence 
information to formulate policy designed to eliminate, minimize, or counter these threats, 
or in other words, manage these risks. In a similar way, risk analysis provides decision 
makers with information to formulate policy to manage risk from natural hazards, 
technological hazards, public health threats, and acts of terrorism. To effectively manage 
risk to national interests and security abroad, intelligence supports making decisions that 
enable appropriate action over time (Sims, J. E. & Gerber, B., 2005). This notion of 
decision-making support, enabling appropriate action over time, and providing 
information about emerging threats to avoid surprise implies strategic thought. The need 
for a greater emphasis on strategic thought in homeland security risk management is 
clear. Risk management experts emphasize the need to improve strategic thinking in the 
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risk management context, greater use of risk assessments for decision making, and 
shifting focus from reacting to past events to one of preparing ourselves for those future 
events that are likely (Government Accountability Office (GAO), 2008). 

Both intelligence and risk analysis support the function of providing warning 
about imminent and emerging threats and hazards to the leaders charged with decision 
making, and to the public by extension. This common thread to support advance warning 
allows leaders to evaluate a wider range of options instead of limiting the available 
options to only the reactive ones. Since the terrorist attacks of 9/11, the call to judge the 
U.S. Intelligence Community on its ability to provide warning of impending catastrophe 
has gained significant strength. This ultimately will allow leaders to implement decisions 
that can prevent or minimize the risk from attacks (Sims, J. E. & Gerber, B., 2005). The 
risk analysis process supports mitigation and emergency preparedness programs in a 
similar manner by providing warning about hazards, vulnerabilities, and consequences to 
decision makers. 

Neither intelligence nor risk analysis exist as static processes, and failure to adapt 
these processes to changes in technology, society, priorities, threats, and the political 
climate will undoubtedly lead to catastrophe in the future. In general terms, we tend to 
frame the problems associated with threats and hazards based on our previous experience. 
Author, David Ropiek, describes the process of how people employ mental short-cuts to 
make judgments in the absence of perfect knowledge as “bounded rationality.” Bounded 
rationality involves a number of concepts that factor into how we view issues that are 
relevant to both intelligence analysis and risk analysis. These include; the idea of 
categorization or representativeness in which we relate new information to a category 
familiar to us; the theory of the endowment effect in which the framing of information as 
a negative or positive connotation changes our perception; the anchoring and adjustment 
effect in which we derive estimates from making adjustments from a known piece of 
information; and the ready recall effect in which the more aware we are the easier the 
information is recalled, and thus the more concerned we are with it (Ropeik, 2010). The 
bias from the cumulative effects of these concepts can easily influence analysis and 
produce short-sided intelligence assessments and risk analysis. 
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Intelligence analysis and risk management exist as dynamic systems that continue 
to evolve with the collection of infonnation. Intelligence failures occur when the 
intelligence process does not improve or experiences degradation of capability (Sims, J. 
E. & Gerber, B., 2005). This problem is characterized by the failure of imagination, 
policies, capabilities, and management outlined in the 9/11 commission report (Kean & 
Hamilton, L. H., 2004). Gerald Harris provides a useful description of this process in his 
book, “The Art of Quantum Planning. ” He describes the quantum change process as a 
situation when a new event enters a situation or system and affects a change resulting in 
adaptation and the establishment of a new equilibrium or steady state (Harris, 2009). The 
terrorist attacks of 9/11 can be seen as such an event to both the intelligence and risk 
management communities in that the event precipitated change and adaption that resulted 
in a new system balance of mission, needs, priorities, and stakeholders. Given events 
with dramatic changes such as this, we must exert effort to preserve existing capabilities, 
while adapting to new requirements communicated by decision makers. 

Facilitating continuous improvement within both the intelligence and risk analysis 
systems is difficult. Chris Bellavita cites Edwards Deming, an authority on continuous 
improvement, in his argument that the fear of new behavior, emergence, and imagination 
get in the way of system improvement and understanding the system processes that 
empower people to determine what needs to be done to facilitate continual improvement 
(Bellavita, 2005). Leadership charged with decision making must be invested in 
improving the intelligence and risk assessment systems. In doing so, they need to 
emphasize the importance of adaptation and the continuous refinement of intelligence 
and risk analysis in order to support their intelligence needs. 

The common threads between intelligence and risk analysis do not end with 
information needs, analysis, mission similarities, and bias or external influences. The 
next section moves the discussion from general similarities to a comparison of the steps 
within the intelligence cycle with those in the risk management cycle. 


50 



c. 


COMPARISON OF THE INTELLIGENCE AND RISK MANAGEMENT 
CYCLES 


It should not be surprising that the intelligence and risk management cycles share 
common attributes given their common goals of supporting policy and decision making 
with the analysis of pertinent data. Even though intelligence and risk management remain 
distinctly separate disciplines, they both rely on a cycle focused on the analysis of 
information. Increased understanding of risk analysis and management practices by 
intelligence professionals could provide insights to improve intelligence, and a greater 
knowledge of intelligence processes could assist risk management professionals to 
strengthen risk analysis and management practices. Both the intelligence cycle and the 
DHS risk management cycle are provided in Figure 6 to orient you to this comparison. 



Figure 6. Comparison of the Intelligence Cycle from (Lowenthal, 2009 p. 65) 
and the DHS Risk Management Process (United States Department of 
Homeland Security (DHS), 2011 p. 15) 


The first phase in both the intelligence cycle and the risk management process 
begins with the establishment of the scope. The intelligence cycle defines this initial step 
as Planning and Direction. In this step, the policy areas where intelligence can contribute 
are identified and prioritized (Lowenthal, 2009). Within the homeland security risk 
management process, the first phase is Defining the Context. This step defines the 
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requirements, constraints, and priorities for the decision or policy objectives to be 
supported by risk management (United States Department of Homeland Security (DHS), 
2011). Additionally, the risk management process includes a step to Identify Potential 
Risk in this incipient phase. This step expands on defining the context by cataloging and 
categorizing the various risks to be considered (United States Department of Homeland 
Security (DHS), 2011). The first two steps in the Carnegie Mellon Risk-Ranking Method, 
provided in Figure 7, align with the scoping that occurs in the planning and direction step 
in the intelligence cycle, and the step to define the context in the DHS risk management 
model. The Carnegie Mellon Risk-Ranking Method provides the basis for comparative 
risk assessment described by Florig et al. (H. K. Florig et ah, 2001). & Morgan et al. 
(Morgan, Florig, deKay, & Fischbeck, 2000). 



Figure 7. Carnegie Mellon Risk Ranking Method from (Florig, K. H., Morgan, 
M. G., Morgan, K. M., Jenni, K. E., Fischoff, B., Fischbeck, P, S.,& DeKay, 

M. L., 2001) 


The next phases in both the intelligence cycle and the risk management process 
include a major focus on gathering data. It is noteworthy that while activities associated 
with these phases are similar, there is a significant difference in how the activities are 
organized and broken down by each respective process. The intelligence cycle includes 
two separate steps that focus on gathering information and preparing it for analysis 
(Lowenthal, 2009 pp. 60-61). These steps are Collection, and Processing and 
Exploitation. Since data achieved though collection is often not ready for use by analysts, 
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the processing and exploitation of the data allows it to be translated and decoded from 
signals to images and intercepts that can be used by analysts (Lowenthal, 2009 p. 61). 
The next step in the homeland security risk management cycle is Assess and Analyze 
Risk. This involves selecting an appropriate risk assessment methodology, gathering 
required data, assess risk, validation of data inputs and outputs, and analyzing the results 
of the assessment (United States Department of Homeland Security (DHS), 2011 pp. 19- 
20). It should be noted that even though the risk management phase of assessing and 
analyzing risk does not include a step for processing and exploitation, this aspect should 
not be overlooked. Depending on which methodology and model are selected for risk 
analysis, geospatial and signals data may need to be processed and exploited before being 
incorporated into a model. Some examples where this is appropriate may include data 
from seismographs, flood gauges, or topographical data obtained with Light Detecting 
and Ranging (LIDAR) technology. 

Analysis occurs in both the intelligence cycle and risk management cycle 
following the collection, processing, and exploitation of data. The intelligence cycle 
labels this step as Analysis and Production. In this phase, intelligence is analyzed and 
various products are produced to meet the needs established by the decision makers 
requiring intelligence support. This includes a range of products tailored to meet the near- 
term or long-range intelligence needs of policy and decision makers (Lowenthal, 2009). 
Although analysis begins with the step to assess and analyze risk in the homeland 
security risk management process, it continues into the step labeled as Developing 
Alternatives. The development of alternatives involves identifying a variety of risk 
management options that support the decision makers and policy objectives, and 
assessing the merits of each (United States Department of Homeland Security (DHS), 
2011). The methodologies may differ between the intelligence process and that of risk 
management, but the common goal is to produce analytical products that meet the defined 
needs of policy and decision makers. 

The differences between the intelligence cycle and the risk management cycle 
related to the collection, processing, exploitation and analysis of information extend well 
beyond the surface depicted in the process diagrams. These differences extend to the 
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culture and organizational mechanics of completing these various tasks. The U.S. 
intelligence recognizes that those performing analysis should drive data collection, 
however, in practice, this is rarely achieved because analysts rarely receive an explicit list 
of priorities from policy makers (Lowenthal, 2009). Analysts tend to be very involved 
with information collection within the risk management community (Committee to 
Review the Department of Homeland Security's Approach to Risk Analysis, 2010). The 
collection, processing, and analysis disciplines within the intelligence community are 
distinctly separate disciplines, and the analysts are often marginalized with respect to 
influencing the data collection priorities needed to support analytical products 
(Lowenthal, 2009). The direct involvement of risk analysts in detennining which data 
collection efforts are worth pursuing based on their ability to reduce uncertainty 
(Committee to Review the Department of Homeland Security's Approach to Risk 
Analysis, 2010 pp. 61). 

The names and descriptions of the final phases of the intelligence and the risk 
management cycles are different; however, they accomplish very similar functions. The 
final phase of the intelligence cycle is Dissemination. In this step, the intelligence 
products are distributed to the decision makers and policy staff requiring the intelligence 
(Lowenthal, 2009). The risk management process implies dissemination while it labels 
the next step as Deciding on and Implementation of Risk Management Strategies. This 
involves providing the assessment of risk management options to the appropriate decision 
makers (United States Department of Homeland Security (DHS), 2011). The DHS risk 
management process follows with a feedback step, which is implied in the intelligence 
cycle. The common goals of these steps involve getting the processed information to 
those who need it to make decisions and receiving feedback on the products and 
additional needs. 

D. INTELLIGENCE SUPPORT OF RISK ANALYSIS 

Intelligence assessments play a significant role in risk analysis within the 
homeland security domain. Evidence for the importance of intelligence assessments in 
supporting risk analysis can be found by examining the various terrorism and 
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infrastructure risk assessment models, guidance and operational concepts for state and 
urban area fusion centers, and strategies for intelligence and homeland security. 

The concept of risk analysis is focused on assigning probabilities to potential 
hazards or threats and gauging the subsequent impacts associated with the event. It is not 
considered a process for predicting the occurrence of a hazard and its impacts. The 
concept of probability is rooted in the mathematical and statistical communication of 
likelihood, and prediction implies a precise forecast about a hazard or threat and its 
consequences at some future point in time (Ropeik, 2010). The term prediction provides a 
false sense of accuracy that can undermine the confidence of decision makers in the risk 
assessments they use to manage homeland security risk (Committee to Review the 
Department of Homeland Security’s Approach to Risk Analysis, 2010). People generally 
hold preconceived notions of how mathematical and statistical patterns are supposed to 
work out; this framing effect, coupled with the innumeracy within the general population, 
contribute to the false sense of accuracy perceived with representations of probability 
(Ropeik, 2010). 

Accuracy and consistency are important characteristics regarding intelligence 
estimates used for risk analysis. Estimates are not predictions but should be considered 
judgments that provide an educated perspective on the likely course of future events 
(Lowenthal, 2009 p. 136). Predictions imply a high degree of accuracy, which presents 
problems with the speculative nature of intelligence products. While intelligence analysts 
strive to be exceptional through accuracy, no one can be correct all of the time; hence, 
consistency is a better way to gauge the value of intelligence (Lowenthal, 2009 p. 148). 
Thus, striving for consistent intelligence assessments is more beneficial to risk analysts 
than trying to achieve completely accurate assessments. These subtle distinctions remain 
important considerations for incorporating intelligence products into risk analysis and 
management. 

It is important to remember that uncertainty exists within the risk analysis 

products for both natural hazards and terrorist threats. However, expert judgments on the 

likelihood and consequences of terrorist threats are perceived to be less precise than those 

for natural hazards for two key reasons. First, human nature and intent is more difficult to 
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understand, predict, and model than the physical aspects of natural hazards. Secondly, 
more empirical data exists for natural hazards for experts to use in making risk 
assessments, where very little useful empirical data exists for experts to call upon in 
developing terrorism threat assessments (Committee to Review the Department of 
Homeland Security’s Approach to Risk Analysis, 2010). 

Risk analysis includes the common variables of threat, vulnerability, and 
consequence for virtually all homeland security risk assessment models, but the scope 
and content of intelligence products used for risk assessments vary widely. The 
intelligence assessments needed to support risk analysis differ significantly based on the 
detailed aspect of a specific threat to be analyzed (Baker et ah, 2009). Furthennore, 
numeric values assigned to threat, vulnerability, and consequence are problematic for 
several reasons as pointed out by Tony Cox in his article, “ Some Limitations of “Risk = 
Threat x Vulnerability x Consequence” for Risk Analysis of Terrorist Attacks. First, he 
explains how threat estimates may be thwarted by attackers using intelligence about the 
threat assessment itself to detennine when and where an attack is most likely to achieve 
its objectives. He also describes how vulnerability values are subject to adapt plans in 
order to continue with attacks when obstacles are identified. These types of variable 
factors are hard to quantify and rely on expert opinion from the intelligence community 
in order to produce assessment of terrorism threats for risk analysis and management 
(Cox Jr., L. A. (Tony), 2008). 

A report from the Homeland Security Institute identifies five main types of 
intelligence threat judgments that support terrorism risk assessment. These include: 
estimation on the likelihood of attacks, attack method, type of adversary making the 
attack, and the adaptability and ability of the attacker to acquire countermeasures (Baker 
et ah, 2009, p. 22). Each of these expert conclusions also depend on any number of 
specific issues that frame the assessment based on the needs of the decision maker or 
intelligence consumer. Intelligence estimates on the likelihood and frequency of attacks 
depend largely on timeframes to delineate the bounds of judgment. Attack assessments 
depend on target and weapon types, domain, tactics and methodology, and terrorist 
characteristics, such as ideology, group identity or lone wolf, and whether or not the 
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attacker is foreign or domestic (Baker et al., 2009). These threat judgments can be 
individually or collaboratively produced by any number of sources at all levels of 
government and the private sector. 

The Homeland Security Institute report identifies several challenges for producing 
threat judgments in support of homeland security risk assessments. These challenges 
impede collaboration and can largely be attributed to the distinct cultural differences 
between the intelligence and risk analysis disciplines. Risk analysis generally includes 
multiple component inputs into a highly structured model. Threat assessments represent 
one input into the process. The production of intelligence threat assessments represents a 
more fluid process driven by the dynamic and conditional nature of threats applied to 
scenario planning (Cummings, McGarvey, & Vinch, 2006b). Additionally, the discipline 
of risk analysis relies strongly on empirical models driven by quantifiable probabilistic, 
vulnerability, and consequence inputs. In contrast, intelligence assessments provide a 
more qualitative analysis that includes substantial uncertainty. This allows the 
intelligence assessments to account for the variables associated with adaptive adversaries 
and tactics in a perpetually changing enviromnent. The periodic interaction with the 
intelligence analysts common to most risk analysis processes can exacerbate these 
challenges. Problems associated with limited interaction include inadequate preparation, 
differing points of view and understanding about scenarios, and the lack of transparency 
and follow-up can hamper productive collaboration between intelligence and risk analysts 
(Baker et al., 2009). 

The afore-mentioned report also describes three primary approaches to 
collaboration between the intelligence and risk analysis communities within the 
homeland security context. These approaches are categorized by frequency of interaction 
to include continuous, periodic, and no direct interaction (Baker et al., 2009). The 
continuous interaction approach includes cross-disciplinary staffing and affords a high 
degree of collaboration. Naturally, this improves communication between intelligence 
and risk analysts and provides the foundation for a more effective relationship. However, 
the high investment of resources and personnel make this approach difficult to 
implement, especially within the construct of state and local government. 
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Periodic interaction between intelligence analysts and their risk counterparts 
requires significant preparation activities by both parties to maximize the effectiveness of 
limited meeting time. While this approach limits the investment of staff and resources 
and provides greater flexibility by affording the opportunity to take advantage of a larger 
pool of intelligence experts, several limitations should be considered. These include the 
need for intelligence analysts to make time to elicit threat analyses requirements, and the 
need for risk analysts to be much more familiar with the intelligence community, so they 
can direct their intelligence needs to the appropriate technical experts (Baker et ah, 2009). 
This intermittent interaction can foster issues known to impede collaborative work to 
include divergent goals, focusing on internal agency concerns and priorities in lieu of 
those held by the collective group, absence of clear goals, want of accountability, lack of 
familiarity with other organizations and insufficient communication and information 
sharing (Hocevar, S. ,P., Thomas, G. F., & Jansen, E., 2006). 

The third approach where no direct interaction occurs reduces workloads, 
conserves resources, and avoids coordination issues (Baker et ah, 2009). However, it also 
reduces the degree to which the knowledge and expertise of the intelligence community 
is leveraged to improve risk analysis. This limited approach strengthens the effect of 
barrier factors referenced in the previous paragraph on collaborative activity.(Hocevar, S. 
P., Thomas, G. F., & Jansen, E., 2006) The absence of direct interaction also may lead 
risk analysts to draw the wrong conclusions and make invalid inferences from 
intelligence products that were not tailored to their specific needs. This segregation 
between intelligence analysts and the risk analysts is similar to the disconnect between 
the intelligence collection discipline and the intelligence analysts, as described 
previously. Mark Lowenthal articulates this challenge in his description of the disconnect 
between collection and analysis with these words, “It is difficult to task a system that one 
does not fully understand” (Lowenthal, 2009). 

The various contributions of intelligence assessments to the wide array of risk 
analysis tools and methodologies become apparent upon a cursory examination of their 
design and function. The various risk analysis techniques, tools and models are each 
designed for a specific purpose and to assist risk management at all levels (Cummings, 

58 



McGarvey, & Vinch, 2006b). These include the tactical focus of mission-based risk 
assessment, the operational focus of system based risk management, and the strategic 
focus of risk-infonned decision making (Cummings, McGarvey, & Vinch, 2006a). 
Additionally, the level of collaboration between the intelligence community and the risk 
analysts differs substantially based on the risk analysis model and context (Baker et ah, 
2009). 

The Strategic Homeland Infrastructure Risk Assessment (SHIRA) provides a 
general snapshot of risk from natural hazards and terrorism to the critical infrastructure in 
the nation. This strategic view of risk incorporates intelligence into risk analysis using a 
mixed staffing approach. This occurs at the Homeland Infrastructure Threat and Risk 
Analysis Center (HITRAC). The continuous interaction between intelligence and risk 
analysts at the HITRAC supports strategic level risk analysis across all sectors (Baker et 
ah, 2009). The Coast Guard’s Maritime Security Risk Analysis Model (MSRAM) 
provides another example of continuous interaction between the intelligence and risk 
analysis communities. However, it does not just rely on traditional classified intelligence 
sources; instead it integrates locally available unclassified information. This enhances the 
site specific effectiveness of the product and makes the assessment easier to share among 
state and local partners (Baker et ah, 2009). In contrast, a strategic risk assessment 
approach that aggregates expert opinions and ranks threats at a strategic level, such as the 
Analytic Hierarchy Process (AHP), may only require periodic interaction (Cummings, 
McGarvey, & Vinch, 2006b).While the limited interaction can impede collaboration, the 
AHP-based approach produces a comparative risk ranking similar to the Carnegie Mellon 
Risk Ranking Method used in comparative risk assessment. This process defines and 
categorizes risks and attributes to form a basis of comparison (Florig, K. H., Morgan, M. 
G., Morgan, K. M., Jenni, K. E., Fischoff, B., Fischbeck, P. S., & DeKay, M. L., 2001). 

The Risk Management Analysis Process (RMAP) employed by the Transportation 
Security Administration (TSA) provides an operational risk management example of how 
periodic interaction between the intelligence and risk analysis communities serves to 
manage risks to commercial aviation security. This process incorporates information 
ranging from Protected Critical Infrastructure Information (PCII), Sensitive Security 
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Information (SSI), (Cummings, McGarvey, & Vinch, 2006b) For Official Use Only 
(FOUO), Law Enforcement Sensitive (LES), and private sector proprietary infonnation. 
This process provides a good example of how different types of infonnation can be 
leveraged among a diverse group of analysts to generate a collaborative intelligence 
driven risk analysis. This requires intelligence analysts to think in unfamiliar ways, and 
work with nontraditional partners. While periodic interaction could be seen as a handicap 
to this process, it motivates risk analysts to make decisions that use analytical resources 
from the intelligence community wisely (Baker et ah, 2009). 

E. BENEFITS OF ENHANCED COLLABORATION AMONG 

INTELLIGENCE AND RISK ANALYSIS 

Multiple sources support the notion that greater collaboration needs to occur 
between the intelligence and risk analysis communities. The Government Accountability 
Office (GAO) convened a forum of risk management experts in 2008. Participants in the 
forum identified the need for risk analysis training for intelligence analysts (Government 
Accountability Office (GAO), 2008). Greater collaboration and integration of intelligence 
and risk analysis to support risk management is the focus of a report published by the 
Homeland Security Institute in 2009 (Baker et ah, 2009). Additionally, a recent article 
titled Intelligence-led Mitigation also emphasized the importance of the relationship 
between the intelligence and risk management process (Townsend, Sullivan, Monahan, & 
Donnelly, 2010). 

A report from the Homeland Security Institute published in 2009 provides four 
key findings related to collaboration between the intelligence community and the risk 
analysis community. These findings call for greater cross-discipline familiarity, 
advancing beyond a “Supply and Demand” perspective to a fully symbiotic relationship, 
systematic engagement to achieve better threat judgments, the need for additional 
research on how to improve threat judgments required for homeland security risk 
assessments (Baker et ah, 2009). These findings provide a conceptual framework to 
explore collaboration between the intelligence and risk analysis communities. 
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The U.S. Intelligence Community recognizes the need for improving 
collaboration among the traditional members of the intelligence community and with 
nontraditional players such as state and local governments. Evidence of this can be found 
in the National Intelligence Strategy, which clearly articulates a strategic need to improve 
collaboration and build partnerships (The Office of the Director of National Intelligence, 
2009). Fonner Director of National Intelligence Mike McConnell makes a compelling 
argument that the intelligence community needs to develop a shared approach that will 
promote effective coordination and integration of work thus increasing the agility of 
agencies to cope with the dynamic landscape of security threats. He identifies the 
importance of integrating law enforcement into the intelligence community and the 
success that DHS and the FBI have achieved in achieving an integrated approach 
(McConnell, 2007). McConnell asserts that the intelligence community needs to abandon 
the long-standing policy of providing information on a “need-to-know” basis and replace 
it with a cultural standard of “responsibility to provide” while providing reasonable and 
prudent protections (McConnell, 2007). This is a central concept for improving 
collaboration among the intelligence community and extending it to the risk analysis 
community (McConnell, 2007). 

Several examples of organizational collaboration between intelligence and risk 
analysis functions exist. The Homeland Infrastructure Threat and Risk Analysis Center 
(HITRAC) demonstrates a collaborative relationship that combines intelligence with risk 
information to produce assessments of risk for all hazards and threats to infrastructure 
networks of national significance. Effective information sharing among local, state, and 
federal government and the private sector allow the HITRAC to produce quality risk and 
threat assessments that are made available to appropriate stakeholder groups (U.S 
Department of Homeland Security, February 2011). The Interagency Threat Assessment 
and Coordination Group (ITACG) provides another example of collaborative work 
between the intelligence and risk analysis community. Although the ITACG does not 
have a risk analysis function, it does support risk analysis within DHS organizational 
components, state, and local government. It seeks to address the intelligence needs of 
state and local government by including state and local personnel on the ITACG staff 
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detail ( Department of homeland security interaction with state and local fusion centers 
concept of operations 2008). State and local fusion centers also provide another example 
of collaboration between intelligence and risk analysis. 

The risk analysis process can inform the intelligence process to produce more 
refined threat assessments. This comports with the notion that greater collaboration is 
needed between the risk analysis community and the intelligence community, and that 
analysts need to be more involved with shaping the scope of threat assessments. In a 
working paper for the Rand Corporation, Henry Willis suggests that the products of risk 
analysis can improve intelligence products, and that risk analysis can assist in shaping 
intelligence collection priorities (Willis, 2007). 

Terrorism threat assessments provide an example of how risk and vulnerability 
analysis can help improve intelligence assessments. Terrorism threat analysis depends on 
opportunity, intent to act (including goals and objectives of terrorist), and the capacity to 
carry out the attack. Willis argues that terrorism risk analysis provides a structure to 
incorporate intelligence about the goals, objectives, and capabilities of terrorist groups 
with the vulnerabilities from various attack modes, and consequences of different types 
of attacks on different targets to focus on scenarios that represent the greatest risk (Willis, 
2007). The ability to focus on the scenarios that provide the greatest risk is precisely the 
type of information required by principal decision makers in developing homeland 
security risk management strategies, although intelligence limitations may limit the 
usefulness of this type of analysis to strategic or operational risk management activities. 
The results of the risk analysis can be incorporated back into the intelligence process at 
the analysis and production stage. This corresponds with the idea of the iterative scenario 
analysis process that incorporates the findings and observations associated with previous 
scenarios to shape the evolution of the next scenario in the sequence for planning 
purposes (Van der Heijden, 2005). The results of this iterative scenario planning process 
can be used in red teaming to dissect various attack scenarios and vulnerabilities to drive 
additional collection activities and select appropriate countenneasure strategies (Willis, 
2007). The benefits to both the intelligence community and risk analysis community are 
best summarized in this statement from the Risk Analysis and Intelligence Communities 
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Final Report from the Homeland Security Institute, “The stakes for both communities in 
improving collaboration mainly hinge on enhancing each community’s organizational 
performance” (Baker et ah, 2009). 

While the mutual benefits of collaboration between the intelligence community 
and the risk analysis community are clear, several challenges must be accounted for and 
effectively managed in order to avoid undermining both the intelligence and risk analysis 
processes. Mr. Willis identifies four key challenges in his working paper: basing analyses 
on available information, matching the resolution of analysis to assessment problem, 
applying the best practices from risk analysis to create intelligence assessments, and 
avoiding blinding analysts to surprise (Willis, 2007). Generally, risk analysis models 
emphasize deliberative quantitative approaches that are transparent and easy to replicate 
so that risk can be communicated effectively. This represents a substantial difference 
from terrorism threat assessments that are more qualitative in nature to address the 
inherent uncertainty associated with terrorism risk (Cox Jr., Louis A. (Tony), 2008). 

Limitations of available data pose a significant challenge to the fusion of the 
intelligence and risk analysis processes. Risk analysis draws upon years of expertise that 
provide a strong methodical foundation for experts and sophisticated models that require 
specific data inputs (Government Accountability Office (GAO), 2008). Without these 
inputs, the analysis goes nowhere and effort is wasted. Intelligence assessments related to 
terrorism do not have years of experience, empirical data, and sophisticated models to 
draw upon. The data and assumptions that produce a risk assessment also define its 
limitations, and thus, risk assessments are blind to scenarios or assumptions that are not 
included in the analysis (Committee to Review the Department of Homeland Security's 
Approach to Risk Analysis, 2010). This also relates to the central idea that the framing of 
data and assumptions is part of human nature as Ropeik argues in his book, “How Risky 
Is It, Really?” (Ropeik, 2010). The best contextual example of this issue can be found in 
the intelligence failure and lack of institutional imagination expressed in the 9/11 
Commission Report (Kean & Hamilton, L. H., 2004). 
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Risk management takes place at different decision-making levels each with 
different intelligence support requirements. Risk assessments support risk management at 
tactical, operational, and strategic decision levels, and each requires a different level of 
resolution to support decision making (Cummings, McGarvey, & Vinch, 2006a). Too 
much or too little detail in assessments can confuse issues and incorrectly frame risk 
issues at each level of decision making. 

F. INTELLIGENCE-LED RISK MANAGEMENT 

State and local governments represent the level of government most often directly 
impacted by the consequences of the wide range of homeland security threats and 
hazards, and thus, have a large stake in developing and implementing sound risk 
management strategies. This fact is recognized by the collaborative white paper, 
“Recommendations for an Effective National Mitigation Effort ” (National Emergency 
Management Association, 2009). This premise is also supported by the Disaster 
Mitigation Act of 2000, which promotes a national strategy to manage natural disaster 
risks through state and local hazard mitigation plans (Federal Emergency Management 
Agency (FEMA), 2007). Additionally, both the National Strategy for Homeland Security 
and the National Infrastructure Protection Plan recognize that the majority of the 
homeland security risks exist within the private sector and in the jurisdiction of a unit of 
state or local government. 

The concept of “Intelligence-Led Mitigation” provides a framework that applies 
the intelligence concepts intrinsic to community policing in a broader construct to address 
the intelligence needs of multiple public safety disciplines. “ Intelligence-Led Mitigation ” 
is described as, “management philosophy and business process to proactively guide 
strategic, operational, and tactical decisions for mitigating the effects of intentional, 
accidental, and natural incidents,” and they offer this concept as a vehicle to address the 
existing gaps in the intelligence products available to support resource decisions 
(Townsend et al., 2010). The Police Executive Research Forum makes the point that 
intelligence is a decision-making tool, and the need to support decision making extends 
beyond artificial boundaries created by missions, jurisdictions, and discipline (Police 

Executive Research Forum, 2005). This point is echoed by the authors of Intelligence- 
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Led Mitigation (Townsend et al., 2010). Two key principles provide the basis for 
intelligence-led mitigation: first, intelligence products are needed to support the decision¬ 
making process for allocating resources for mitigation; and second, that decision makers 
need to clearly communicate their intelligence/information needs (Townsend et ah, 
2010). Ultimately, the concept of Intelligence-led mitigation suggests that the application 
of the intelligence process provides an added value to the decision-making process for 
mitigating any hazard, not just criminal and terrorism threats. 

Intelligence-led risk management represents the fusion of the intelligence cycle 
and risk management process. This concept builds on the key elements offered by 
Intelligence-led Mitigation by injecting the principles of intelligence cycle into the 
development of the risk management culture within the homeland security enterprise. 
Figure 8 depicts how the intelligence cycle and risk management process are fused to 
promote risk management driven by intelligence. The hub of the intelligence-led risk 
management process is communication. A shared understanding of the risk and its 
associated factors is achieved through consistent communications with those charged 
with decision making, managing aspects of the cycle, and analyzing and producing 
assessments throughout the process. 
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Risk Management 
Context 



Figure 8 Intelligence-Led Risk Management 


The Intelligence-Led Risk Management process takes place within the context 
established by leadership, and those ultimately responsible for making risk management 
decisions. Several factors need consideration to frame the risk management context, 
which include: goals and objectives, mission space and organizational values, policies, 
decision scope and criticality, decision makers and stakeholders, decision timeframe, 
capabilities and resources, risk tolerance, and information availability (United States 
Department of Homeland Security (DHS), 2011). The context provides the boundaries 
for the risk management efforts. The information relevant to these factors must be shared 
with those involved in directing the collection, processing, exploitation and analysis for 
quality results and efficiency. Providing this information helps analyst direct collection 
and communicates priorities for processing and exploitation thus allowing their products 
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to provide the required support of the decision process. This fits with the notion of 
analyst driven collection, offered by Lowenthal, that the U.S. intelligence strives for, but 
ultimately finds elusive (Lowenthal, 2009). 

The Intelligence-Led Risk Management process is a cycle that begins with 
developing a plan and directing the efforts of process components. This first step includes 
planning and directing the collection of information, analysis, assessment/judgment 
products to be developed, and how they will be disseminated. The intelligence 
analysis/production step and risk analysis/production step represent a codependent 
relationship within the cycle. These two interdependent steps occur in parallel providing 
information to each other that continue to refine both intelligence and risk assessments. 

Intelligence-Led Risk Management cycle continues with dissemination of the 
assessment products after they have been refined to the appropriate resolution. When the 
assessments are received by the appropriate parties, a spectrum of alternatives to address 
the risk is generated for the decision makers. Upon the presentation of the alternatives, 
the decision makers select the alternatives to be implemented. After, the implementation, 
the risk is monitored and reevaluated. Hence the cycle perpetuates. 

State and Local Fusion Centers (SLFCs) provide a capable and logical mechanism 
to implement the idea of Intelligence-Led Risk Management, thus improving 
coordination and collaboration between intelligence and risk analysis activities at the 
state and local level of government. DHS guidance on fusion center capabilities stresses 
the importance of data collection and analysis to meet the strategic mission of the center 
defined by the state or urban area which it serves (United States. Department of 
Homeland Security, 2008). 

State and local governments need an intelligence driven approach for risk 
management. Dr. James Steiner provides a reasonable argument that intelligence needs of 
state governments extend beyond the tactical or operational intelligence needed to 
support law enforcement and include the need to provide strategic intelligence, as well, in 
order to effectively manage the unique threats and risks to any given state (Steiner, 2009). 
Governors and local government elected officials need strategic level decision-making 
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support to adequately address and manage the various risks and threats present in an 
interconnected world (Chen, 2009). The U.S. Department of Homeland Security 
identifies risk assessment as a baseline capability for SLFCs (United States. Department 
of Homeland Security, 2008). DHS also identifies a mission similar to the mission of the 
Homeland Infrastructure Threat and Risk Analysis Center (HITRAC) for state and local 
fusion centers. This mission is to ensure the inclusion of critical infrastructure and key 
resource information in state and regional risk assessments ( Critical infrastructure and 
key resources (CIKR): Protection capabilities for fusion centers [December 2008] [an 
appendix to the 'baseline capabilities for state and major urban area fusion centers'], 
2008). 

In fact, a majority of state and local fusion centers examined for a 2007 report to 
Congress indicated that they saw their primary mission as one of prevention and 
mitigation (Masse, T., Rollins, J., 2007). The location of fusion centers within state and 
local government afford them the opportunity to support emergency services and 
homeland security operations with accurate and timely intelligence. While DHS supports 
the creation and operation of SLFCs, they are developed and maintained by the respective 
state and local governments they serve. Fusion centers may strive to achieve the 
capabilities specified by DHS, their scope, capabilities, and structures are determined by 
the unique needs and resources available to the jurisdictions that created them. 

State and Local Fusion Centers (SLFCs) provide a structure that can incorporate 
some of the best attributes from the Transportation Security Administration’s Risk 
Management Analysis Process (RMAP) and the U.S. Coast Guard’s Maritime Security 
Risk Analysis Model (MSRAM) into state and local risk assessments. The RMAP 
process compiles a variety of infonnation with different handling requirement from 
multiple sources to include the private sector (Baker et ah, 2009). The flexibility inherent 
to SLFCs allows them to organize their operations in such a manner to handle different 
types of infonnation from multiple sources. This flexibility also provides an opportunity 
for intelligence analysts and risk analysts to work closely together on a regular basis, 
which improves the ability of both intelligence and risk analysts to understand and 
appreciate the thought processes of the other. An important factor of the MSRAM 
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success is the continuous interaction between intelligence analysts at the national level 
and state and local stakeholders. This interaction provides a methodology to incorporate 
locally available unclassified infonnation into the process without the classification 
barriers common to traditional intelligence sources (Baker et ah, 2009). The end result is 
a higher quality risk assessment that is more easily shared with state and local 
stakeholders. 

The specific intelligence and risk analysis needs of local, state, and federal 
government differ significantly in terms of their scope. Their utility depends on active 
participation and possession of the collection and analysis of information, and 
transparency. Willis articulates the importance of this point in his working paper (Willis, 
2007). A report to Congress also emphasizes the importance of state and local ownership 
in the fusion centers they sponsor and operate (Masse, T., Rollins, J., 2007). Additionally, 
Dr. Steiner emphasizes the need for state and local intelligence enterprises to know their 
mission, and most importantly their primary intelligence customers (Steiner, 2009). 

The concept of intelligence-led risk management paired with state and local 
fusion centers provides a viable set of tools to integrate intelligence and risk management 
within state and local government to drive the risk management process. Although nearly 
forty percent of fusion centers consider themselves to be all-crimes/all-hazards in nature, 
the term “all-hazards” is not consistently used throughout the SLFC community (Masse, 
T., Rollins, J., 2007). This issue in itself is not problematic as long as the agencies 
participating and relying on the respective state and local fusion centers for intelligence 
and analysis have a common understanding of how the term all-hazards is applied within 
their construct. 

As the idea of Intelligence-Led Risk Management suggests, the strengths of both 

intelligence and risk analysis can be leveraged to support insightful risk management 

decision making throughout the homeland security enterprise. The fusion of these 

independent, but complementary disciplines, can support strategic, operational, and 

tactical decisions for managing risks prior to, during, and in the aftermath of any kind of 

incident with homeland security implications. The greatest beneficiaries will likely be 

local and state governments who bear the greatest share of responsibility for domestic of 
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risk management in our federal system of government. This approach will rely on 
effective collaboration to overcome the cultural barriers and complex problems inherent 
to the homeland security enterprise. 

G. CONCLUSION 

A close relationship exists between the concepts of intelligence and risk 
management. While both risk management and intelligence remain important 
independent disciplines within the context of homeland security, shared learning and 
exchange between them can be mutually beneficial. Risk analysis provides the key link 
between the intelligence and risk management. 

Intelligence-Led Risk Management provides one approach to draw the 
intelligence and risk management disciplines together. By fusing the intelligence and risk 
management cycles, Intelligence-Led Risk Management can support the infonnation 
needs of decision makers for risk management. This concept enables decision makers to 
prioritize and direct the collection and analysis of information to support the goals and 
objectives within risk management context. 

Collaboration and strategic planning play an important role in linking the 
intelligence and risk management functions within homeland security. The next chapter 
explores collaboration and strategic planning with a focus on how to improve the linkage 
between intelligence and risk management. 
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IV. COLLABORATION AND PLANNING FOR STRATEGIC RISK 

MANAGEMENT 


The concept of collaboration penneates the homeland security enterprise by 
design and necessity. Even the casual observer can identify risk management and 
intelligence as inherent pieces of the homeland security enterprise requiring 
collaboration, but the breadth and complexity of these issues continue to pose strategic 
and operational challenges to collaborative efforts among all homeland security 
stakeholders. The scope of risk management permeates the homeland security enterprise 
requiring collaborative work to support many applications to include; strategic planning, 
capabilities-based, planning, resource decisions, operational planning, exercise planning, 
real-world event response and recovery, and research and development, as described in 
the Homeland Security Risk Management Doctrine published in April 2011. 

The concept of Intelligence-Led Risk Management provides a vehicle to promote 
collaboration between intelligence and risk management in support of informed decision 
making within the homeland security enterprise. As such, the implementation of 
Intelligence-Led Risk Management needs to capitalize on those factors that enable and 
promote collaboration while effectively managing the issues that inhibit effective 
collaboration. This chapter explores both the enabling and factors and impediments. It 
also seeks to explain their influence on the success or failure of collaborative efforts. 
These factors relate to the institutional risks that are associated with an organizations 
ability to build and maintain effective management and control systems and adapt to 
dynamic organizational requirements. 

This chapter identifies factors that influence collaboration, and seeks to develop 
strategies to foster and encourage collaboration among decision makers and stakeholders 
from all levels of government, the private sector, and among the many disciplines 
involved in managing risks within the homeland security environment. These factors will 
be applied to strategic thought and planning principles and the Cynefin Framework. This 
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fusion of concepts will produce guiding principles that ultimately enable Intelligence-Led 
Risk Management to promote collaboration and strategic adaptability within the 
homeland security risk management landscape. 

A. THE NEED FOR COLLABORATION IN RISK MANAGEMENT 

Risk management and intelligence within the homeland security context share a 
codependent relationship, as described in previous chapters. In this sense, risk 
management relies on threat assessments from the intelligence community to assess risk; 
and the intelligence community requires direction and an understanding of expectation 
placed on the assessment from the risk analysts. 

The need for greater collaboration in homeland security risk management has 
been identified in several recent documents and studies. The recently published 
Homeland Security Presidential Policy Directive-8, for example, emphasizes a 
collaborative preparedness framework. Risk management and intelligence and 
information sharing are also both listed as common target capabilities in the DHS Target 
Capabilities list, which implies a broad scope with an inherent need for collaborative 
work (United States. Department of Homeland Security, 2007). The National Emergency 
Management Association identified these three strategic themes in building a national 
mitigation effort to manage risks, all of which either directly assert or imply the need for 
collaboration: broader collaborative partnerships, total-hazard awareness, and full 
spectrum community-to-federal emphasis (National Emergency Management 
Association, 2009). Additionally, the 2009 report from the Homeland Security Institute 
identifies specific needs for improving collaboration between the risk analysis 
intelligence communities, which include; improving cross-discipline familiarity, moving 
beyond a supply and demand to a mutually beneficial relationship, and leveraging 
systematic engagement to achieve better threat judgments (Baker et ah, 2009). These 
examples are not outliers and comport with the recommendations and findings of 
additional reports and strategies within the homeland security domain that call for 
stronger collaborative efforts. 
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With the emphasis and importance placed on collaboration within the homeland 
security environment, we need to consider the question: why does collaboration continue 
to endure as a challenge for local, state, and federal government and the private sector? 
The homeland security enterprise continues to demonstrate shortfalls in its collaborative 
ability through poor information sharing among agencies, confusion over inter- 
organizational relationships, competing roles and responsibilities, and shortcoming in 
leadership (Hocevar, S. P., Jansen, E., & Thomas, G. F., 2011). The notion that 
collaboration is an important component of the homeland security enterprise, and that we 
should do a better job of collaborating at each level of government and between 
disciplines, has been established and reiterated through numerous studies and reports. But 
as Hocevar, Jansen, and Thomas observe, studies addressing “how” to collaborate are far 
fewer that the ones that define the need to collaborate, and thus, we should develop a 
better understanding of how to collaborate if we are going to be successful (Hocevar, S. 
P., Jansen, E., & Thomas, G. F., 2011). 

B. HOW TO COLLABORATE: ENABLERS & BARRIERS 

To understand what enables or arrests collaborative efforts, we need to first 
understand the concept of collaboration within the homeland security context. Pelfrey 
defines collaboration as, “agencies, organizations, and individuals from many tiers of 
public and private sectors, working, training, and exercising together for the common 
purpose of preventing terrorist threats to people or property.” (Pelfrey, 2005). While 
sound, this definition misses several key elements found in this definition offered by a 
public agency director: “ Collaboration is the act or process of “shared creation ” or 
discovery. [It] involves the creation of new value by doing something new or different ;” 
(Thomson & Perry, 2006). Two key ideas missing from Pelfrey’s definition are those of 
“shared creation” and “discovery.” These ideas provide an added value to the 
collaborating organizations that allow them to redefine paradigms and adapt their 
practices accordingly. The notion of shared creation and discovery align with the idea of 
“shared learning,” which is identified as a lateral mechanism for enabling collaboration 
(Hocevar, S. P., Jansen, E., & Thomas, G. F., 2011). For our purposes, we will combine 
these concepts to define collaboration as, agencies, organizations, and individuals from 
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many tiers of public and private sectors working together to develop a common 
understanding of homeland security risks and threats and to create effective strategies to 
manage those risks through shared discovery. 

Hocevar, Jansen and Thomas provide insight into the ability of organizations to 
collaborate, which they identify as Inter-organizational Collaborative Capacity (ICC), 
and define it as “the capability of organizations (or a set of organizations) to enter into, 
develop, and sustain inter-organizational systems in pursuit of collective outcomes.” 
(Hocevar, S. P., Jansen, E., & Thomas, G. F., 2011). As shown in Figure 9, their 
construct of collaborative capacity involves five key components, which include: purpose 
and strategy, structure, lateral mechanisms, incentives, and people (Hocevar, S. P., 
Jansen, E., & Thomas, G. F., 2011). Thompson and Perry provide a different perspective 
in which they identify the five dimensions of collaboration that include; governance, 
administration, autonomy, mutuality, and trust and reciprocity (Thomson & Perry, 2006). 
These perspectives differ significantly and complement each other nicely in exploring 
how organizations can collaborate within the homeland security environment. The ICC 
model provides a vehicle to assess the various factors that enable an organization to 
collaborate with others (Hocevar, S. P., Jansen, E., & Thomas, G. F., 2011). Thompson 
and Perry’s offer a framework with five dimensions to assess the process of collaboration 
between organizations (Thomson & Perry, 2006). 

The ICC Model builds on a study conducted by Hocevar, Jansen and Thomas that 
identifies two categories identified as “success” and “barrier” factors within the five 
domains of organizational design. Their analysis provides insight on how they influence 
organizational capacity to collaborate. Both categories are further stratified according to 
the organizational design components that include; purpose and strategy, structure, lateral 
mechanisms, incentives, and people (Hocevar, S. P., Thomas, G. F., & Jansen, E., 2006). 
Effective collaboration remains elusive without a number of conditions, which include a 
perception of need to collaborate, common goals, adaptability, interpersonal networks, 
the ability and willingness to share information, leadership, and mutual trust (Hocevar, S. 
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P., Jansen, E., & Thomas, G. F., 2011). Table 2 lists both the “success” and “barrier” 
factors for each of the organizational design aspects (Hocevar, S. P., Thomas, G. F., & 
Jansen, E., 2006 p. 8). 
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Figure 9. Inter-Organizational Collaborative Capacity Model from (Hocevar, S. 

P., Jansen, E., & Thomas, G. F., 2011) 
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Table 2. 


Factors Affecting Inter-Organizational Collaboration from (Hocevar, 
S. P., Thomas, G. F., & Jansen, E., 2006) 


Factors Affecting Inter-Organizational Collaboration 

Organizational Design 
Component 

“Success” or Enabling Factors 

“Barrier” or Inhibiting Factors 

Purpose & Strategy 

• Feeling of “need” to collaborate 

• Common Goal 

• Recognized interdependence 

• Adaptable to interests of other 

organizations 

• Divergent goals 

• Focus on single agency or 

organization 

• Lack of goal clarity 

• Not adaptable to interests of 

other organizations 

Structure 

• Formalized coordination roles 

• Sufficient authority of participants 

• Impeding rules / policies 

• Inadequate authority of 

participants 

• Inadequate resources 

• Lack of accountability 

• Lack of formal roles / 

procedures for managing 

collaboration 

Lateral Mechanisms 

• Social capital 

• Effective communication & 

information exchange 

• Lack of familiarity with other 

organizations 

• Inadequate communication and 

infonnation sharing 

• Distrust 

Incentives 

• Leadership support and commitment 

• Collaboration requirement for 

funding 

• Acknowledged benefits 

• Absence of competitive rivalries 

• Competition for resources 

• Territory 

• Organizational-level distrust 

• Lack of mutual respect 

• Apathy 

People 

• Appreciation of others’ perspectives 

• Competency for collaboration 

• Trust 

• Commitment & motivation 

• Lack of competency 

• Arrogance 

• Hostility 

• Animosity 


The five domains and thirteen factors provided in the Inter-organizational 


Collaborative Capacity (ICC) model developed by Hocevar, Jansen and Thomas provide 
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a useful frame to examine interagency collaboration. The findings of several reports 
related to interagency collaboration in government fit nicely within the ICC framework 
(Hocevar, S. P., Jansen, E., & Thomas, G. F., 2011). The five domains within the ICC 
model generally align well with four of the five dimensions of collaboration offered by 
Thompson and Perry. The fifth dimension offers a different perspective that offers insight 
into conflict within collaborative organizations. 

The first two dimensions offered by Thompson and Perry include governance and 
administration, which are structural in nature and align with the structural domain and 
factors from the ICC model. Governance addresses the formal and informal structuring of 
how organizations jointly make decisions and reach agreement. The governance concept 
implies the absence of a hierarchical scheme to divide labor, an awareness that decisions 
need to be reached, an acceptance that collaborating entities have their own interests and 
that decisions represent consensus and not coalitions. Additionally, governance supports 
information sharing, transparency, and respect for diverging points of view (Thomson & 
Perry, 2006 p. 24). This point is echoed in the research conducted by Hocevar, Jansen 
and Thomas that indicates the need for a shared purpose, goals, and structured process to 
reach consensus, while avoiding an overly centralized top-down hierarchy(Hocevar, S. 
P., Jansen, E., & Thomas, G. F., 2011). The administrative dimension provides the 
mechanism to move the governance to action. The lateral nature of collaborative groups 
still requires administrative oversight, which is accomplished by partners assuming 
different roles for which they are well suited. Aside from the leadership, technical and 
other administrative support roles, the management of relationships between 
organizations also plays an important role (Thomson & Perry, 2006 p. 25). 

Thompson and Perry’s next two dimensions, which include mutuality, trust and 
reciprocity, align with the lateral mechanisms, incentives, and people domains of the ICC 
model. The mutuality dimension represents symbiosis and interdependence within the 
collaborative structure (Thomson & Perry, 2006 p. 27). The ability of mutuality and 
lateral mechanisms to enable successful collaboration depends on establishing linkages 
that correspond to the interdependence of agencies and organizations (Hocevar, S. P., 
Thomas, G. F., & Jansen, E., 2006 p. 22). Thompson and Perry explain the concept of 
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trust and reciprocity in a context that manifests in two separate ways, which are short¬ 
term or contingent, and long-term or obligatory. The short-term/contingent variation of 
reciprocity dominates early collaborative efforts in which the willingness of collaborating 
partners to interact and share with others depends on the willingness of the other partners 
to do the same. They go on to explain that collaborative partnerships can evolve to long¬ 
term/obligatory reciprocity over time with continued interaction where trust and 
obligation motivate partners to engage in collaborative activity (Thomson & Perry, 2006 
p. 27). 

Thompson and Perry’s final dimension of collaboration is autonomy. It does not 
align with the ICC model, but it does offer insight into how conflict can develop within 
collaborative structures. The concept of the autonomy dimension stems from the reality 
that members of collaborative groups actually have two separate identities; one for their 
organization and its authorities, and another one as a member of the collaborative group. 
This creates an internal struggle between organizational self-interest and the interests of 
the collective group (Thomson & Perry, 2006 p. 26). This reality emphasizes the 
importance of conflict management to address conflict within the coordination group and 
potential conflict with an individual organization. Thus, conflict management should be 
incorporated into the guidance and administrative components of the collaborative 
framework. 

Weiss and Hughes offer some key ideas on how to manage and benefit from 
conflict in collaborative environments. They propose that structured and consistent 
approach for conflict resolution within the group coupled with establishing ordered 
criteria to evaluate trade-offs preserve integrity and collaborative relationships. 
Additionally, they emphasize the importance of joint and transparent escalation in those 
circumstances where resolution cannot be achieved at the point of conflict (Weiss, J., & 
Hughes, J., 2005). The ideas from Weiss and Hughes fit with the concept of structure 
from the ICC model, and the governance and administration dimensions from Thompson 
and Perry’s model. Together these concepts support structure, consistency, and 
transparency with respect to conflict management. 
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The structure and administrative aspects of collaboration, described in the ICC 
model and by Thompson and Perry, can easily be seen in the homeland security context. 
State and major urban area fusion centers provide a visible example of these elements 
working together to enable collaboration that is relevant to intelligence and risk 
management. The ICC strategy domain is represented by the fact that fusion centers were 
bom from a common need among agencies to enhance what was communicated in the 
Interim National Preparedness Goal ( Interim National Preparedness Goal: Homeland Security 
Presidential Directive 8: National Preparedness, 2005). The ICC structure domain and 
Thompson and Perry’s structure and administration dimensions are recognized in the 
governance, concept of operations, and procedures as recommended by the baseline 
capabilities produced by DHS (United States. Department of Homeland Security, 2008). 

Lateral mechanisms, described in the ICC model, can also be seen in the 
homeland security fusion centers. The mechanisms for information exchange and data 
sharing inherent to fusion centers, the social capital from interpersonal networks, and the 
trust developed between organizations by working together represent the lateral 
mechanism domain from the ICC model. The accesses to enhanced analytic capability, 
exchange of infonnation, and support for many missions across multiple agencies provide 
incentives, as described in the ICC model. The multiple agencies and disciplines working 
together in a fusion center help to enable an appreciation for different points of view 
based on experience and expertise, as well as building trust and a sense of teamwork 
among colleagues that aligns with the people domain of the ICC model. These last three 
elements also comport with the ideas associated with the dimensions of mutuality and 
trust and reciprocity presented by Thompson and Perry. 

The collaboration present within state and major urban area fusion centers also 
includes examples associated with Thompson and Perry’s autonomy dimension in 
collaborative processes. Agencies participating in fusion centers maintain an 
organizational self-interest identity and a separate identity as part of the collaborative 
group that is the fusion center. Law enforcement agencies tend to push the fusion center 
towards a law enforcement centric focus, which aligns with their own interest, while state 
homeland security agencies may push for a strong commitment to an all-hazards 
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approach that serves their agency interest. This point of friction between the two points of 
view is documented in the Baseline Capabilities for State and Major Urban Area Fusion 
Centers (United States. Department of Homeland Security, 2008). 

Additionally, the autonomy dimension can be seen between levels of government 
represented in fusion centers. City and county law enforcement agencies and federal law 
enforcement agencies participating in a state level fusion center may experience conflict 
between the interests and priorities of their agencies and those of the fusion center. The 
challenges inherent to collaboration among different levels of government will be 
explored in the next section, which explores collaboration and federalism. 

C. HOMELAND SECURITY COLLABORATION THROUGH 

FEDERALISM 

The political governance structure of the United States is based on idea of 
federalism. The concept of federalism is built on the premise that two levels of 
government exercise sovereignty over the same people in the same territory 
simultaneously (Clovis, 2006 p. 3). The fundamental basis of this political theory 
suggests that some level of collaboration exists between the two levels of government in 
order to exercise power in the same space over the same people. The U.S. model, based 
on the Constitution, is known as dual-federalism because each level of government 
exercises the power and provides the services accorded by the Constitution (Clovis, 2006 
p. 3). 

In a collaborative sense, three domains from the Inter-organizational 
Collaborative Capacity (ICC) are clearly present within the structure. The ICC domain of 
purpose and strategy is evident in the evolution from the Articles of Confederation to the 
establishment of the Constitution. The states abandoned the Articles of Confederation to 
create a more balanced system, which resulted in the drafting and adoption of the 
Constitution (Clovis, 2006, p. 3). It provided a better structure for their common purpose 
and recognized interdependencies such as national defense. The ICC domain of 
incentives can be seen in the acknowledged benefit of collaboration, which was initially 
recognized in commerce and national defense. The ICC structure domain is represented 
by the Constitution, which provides the fonnalized structure to enable this collaboration. 
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The Constitution provides for enumerated or specific powers, which are given to the 
national government, and the Tenth Amendment to the Constitution stipulates that the 
reserved powers not implicitly granted to the federal government are left to the state 
governments (Clovis, 2006 p. 4). 

The autonomy dimension described by Thompson and Perry also exists within the 
federalism system of government within the United States. State governments maintain 
two separate identities, one as a sovereign entity, and another as a member of the United 
States. Sometimes their self-interests conflict with the interests of the central government. 
In these cases, the Supreme Court of the United States is identified as the adjudicating 
body (Clovis, 2006, p. 4). 

Since the governmental structure of the United States is rooted in federalism, it 
provides the framework for the organizational framework for collaboration on homeland 
security issues between agencies of the federal government and those within state 
governments and local governments. The premise of this idea rests on the fact that the 
security and safety of the United States and its citizens is both a mutual goal and 
responsibility ( National Strategy’ for Homeland Security: October 2007). The quality and 
effectiveness of collaboration within the federalism structure of our government 
ultimately dictates the degree of success that can be obtained between federal agencies, 
state, and local governments in achieving homeland security goals and objectives 
including those related to risk management and intelligence. This idea is supported by the 
following statement from the National Strategy for Homeland Security: 

Throughout the evolution of our homeland security paradigm, one feature 
most essential to our success has endured: the notion that homeland 
security is a shared responsibility built upon a foundation of partnerships. 
Federal, State, local, and Tribal governments, the private and non-profit 
sectors, communities, and individual citizens all share common goals and 
responsibilities - as well as accountability - for protecting and defending 
the Homeland. 


(National Strategy for Homeland Security: October 2007). 
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National homeland security policy, and by extension its goals and specific 
programs, do not include state and local governments as lull collaborative partners in the 
homeland security policy model as it exists today. A finding in a Heritage Foundation 
report states, “Despite being essential and equal partners with the federal government in 
defending the homeland against terrorism, state and local governments have little say in 
the development of national policy.” (Mayer, M. A., Carafano, J. J., and Zuckennan, J., 
2011). Clovis argues that the attacks of 9/11 resulted in a dramatic power shift in 
federalism towards a more centralized federal government similar to other times of crisis 
throughout our history (Clovis, 2006, p. 9). This argument from Clovis fits with the 
assertion that the federal government’s homeland security policies continue to encroach 
on the activities that have previously been the purview of state and local governments 
(Mayer, M. A., Carafano, J. J., and Zuckennan, J., 2011). 

This centralization of power in the federal government has left state and local 
government with a diminished voice on homeland security policy issues (Mayer, M. A., 
& Baca, L., 2010). This translates directly to the risk analysis and management within 
the homeland security enterprise. DHS acknowledges the need to include more state and 
local threat and risk information into its assessments by establishing a goal to do so 
(Committee to Review the Department of Homeland Security's Approach to Risk 
Analysis, 2010, p. 59). Additionally, a DHS official is quoted as saying that state and 
local risk and threat information was not being included in federal assessments in a 
meaningful approach in a 2007 report from the Congressional Research Service (Masse, 
T, Rollins, J, and O’Neil, S, 2007). 

State and local homeland security activities tend to be more driven by grants than 
by risk management priorities. A review of documents such as the National Preparedness 
Goal, Homeland Security Presidential Policy Directive 8, Target Capabilities List, and 
homeland security grant guidance provided to the states support this observation. Clovis 
makes an argument and provides evidence to support his claim that grant programs 
provide the vehicle by which the federal government preempts local and state 
prerogatives through the dictation of special requirements to achieve specific goals 
(Clovis, 2006). These arguments and on-going friction within the U.S. system of 
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federalism emphasizes how inadequate communication and coordination of information, 
organizational distrust, competition for resources, and arrogance can negatively impact 
collaboration. 

The existing homeland security policy system includes a number of “barrier 
factors” that impede effective collaboration within the federalism system. Clovis 
stipulates, “The major tensions in the past, continuing to present times, have been related 
to the struggle for power between the states and central government.” (Clovis, 2006, p. 
4). State and local government’s limited ability to comment on homeland security policy 
after it has been discussed, drafted, developed, and circulated coupled with the fdtering 
and editing of input to policy committees from state and local governments is 
disingenuous to the policy-making process (Mayer, M. A., & Baca, L., 2010). Bellavita 
postulates the national government has embraced the opportunity to decide what is best 
for homeland security through default, arrogance, and careerism of federal leadership 
(Bellavita, 2005, p. 7). Clovis explains that certain aspects of the existing structure 
represent coercive federalism to include stronger and tighter conditions of grant-in-aid 
programs and preemption of state choices, federal judiciary interference in the business 
of state and local government, and greater use of under- or unfunded mandates to coerce 
action within state and local governments (Clovis, 2006, p. 8). Bellavita describes the 
existing homeland security organizational paradigm as “a well oiled machine steered by 
an informed central authority,” and he goes on to explain the federal government remains 
entrenched in their hierarchal system with a fear based on not trying or being able to 
control everything (Bellavita, 2005, p. 7). These issues undermine collaboration between 
federal agencies, state, and local governments by fostering many of the “barrier factors” 
listed in Table 2. 

While the existing variation of federalism represents significant challenges to 
collaboration among the different layers of government within the United States, changes 
can be made to the system to enable stronger collaboration, and hence, improve the 
efficiency and effectiveness of homeland security. Clovis points out that a tradition of 
collaborative federalism exists in long-standing arrangements between the Federal 
Emergency Management Agency (FEMA) and the Center for Disease Control and 
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Prevention (CDC) (Clovis, 2006, p. 13). Matt Mayer and Sheriff Baca suggest that a 
many of the vital tasks within the national homeland security enterprise are decentralized, 
and that success of the enterprise requires greater information sharing, robust state and 
local representation as full partners, and a shift away from the rigid federal-centric 
approaches (Mayer, M. A., & Baca, L., 2010). Clovis proposes that congress through its 
executive agent DHS should provide leadership through facilitation instead of directing 
by providing guidelines, milestones and funding in the form of block grants; and that 
state and local governments are positioned with greater flexibility to implement programs 
and thus should collaborate vertically, horizontally, and with other jurisdictions to 
facilitate the flow of infonnation and the most efficient and effective implementation 
programs (Clovis, 2006, pp. 17-18). The Interagency Threat Assessment and 
Coordination Group (ITACG) is model that incorporates state and local perspectives in 
the intelligence process, and indicate this model should be emulated to foster greater 
involvement of state and local partners in shaping homeland security policy and priorities 
(Mayer, M. A., Carafano, J. J., and Zuckerman, J., 2011). These ideas represent an 
opportunity to embrace the “success factors” for collaboration while managing the 
“barrier factors.” 

As the foundation for the relationship between state and local government and the 
federal government of the United States, federalism provides the conceptual framework 
in which collaboration between these levels of government must occur. The federalism 
concept as it exists in the American experience includes both enabling and barrier factors. 
Effective collaboration for homeland security risk management will require strategic 
planning and thought to exploit the enabling factors and manage the challenges. The next 
two sections provide a discussion of strategic planning and thought, and offer ideas on 
how to leverage these concepts and principles to advance collaborative efforts between 
intelligence and risk management. 

D. APPRECIATIVE INQUIRY, THE CYNEFIN FRAMEWORK, AND 

STRATEGIC PLANNING FOR STRATEGIC COLLABORATION 

The homeland security enterprise exists as a complex adaptive system in which 
risk management plays a central role. This complex environment presents many 
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competing priorities, demands for resources, and opportunities that must be balanced to 
consider multiple man-caused and natural threats in a dynamic political and social 
environment (United States Department of Homeland Security (DHS), 2011). Risk 
management provides the process to include these factors in the discussion and decision 
making at the strategic, operational and tactical levels. The discourse afforded by risk 
management enables the development and joint pursuit of state, regional, and national 
goals and objectives for homeland security. Effective collaboration for risk management 
provides the vehicle to achieve equilibrium amid these competing factors. Principles of 
strategic thought and planning are required to enable the collaborative processes 
demanded for homeland security risk management. 

Collaboration requires elements of structure and strategy to achieve the results 
desired by the entities invested in the collaborative process. The field of strategic 
planning offers several ideas and theories that can be leveraged to improve the 
collaborative effort to strategically manage risk within the homeland security domain. 
This chapter explores how strategic thought and planning principles, the concept of 
Appreciative Inquiry, and the Cynefin Framework can work together to improve 
collaboration and the strategic approach to risk management. 

1. Appreciative Inquiry 

The concept of appreciative inquiry provides an approach to improve system 
capability through asking questions to seek infonnation and better a better understanding 
of the environment. Barrett and Fry define Appreciative Inquiry (AI) as, “a strength- 
based, capacity building approach to transform human systems toward a shared image of 
their most positive potential by first discovering the very best in their shared experience” 
(Barrett and Fry, 2005, p. 25). AI exudes collaboration by fostering a dialog among 
cooperative members to capture examples of past and present success stories, 
organizational pinnacles, and epiphanies to replicate and adapt them to improve systems 
and discover what is possible. This foundation provides an environment that encourages 
investing social capital and exchanging best practices among organizations. 
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While actively promoting collaboration, the appreciative inquiry concept also 
limits “barrier factors.” The AI process seeks system improvement by focusing and 
building on positive attributes instead of defining and fixing deficiencies (Barrett & Fry, 
2005, p. 31). This shift in discourse from “fixing problems” to “replicating success” 
frames collaborative conversations in a positive manner, thus promoting trust and the free 
exchange of information and ideas. Al also avoids fragmentation by focusing on systemic 
and organizational improvement instead of the traditional analytic approach of breaking 
problems down into component parts creating specialization and trend towards myopic 
focus (Barrett & Fry, 2005, p. 30). Specialization and too much attention to the 
subcomponents of complex problems can produce divergent goals and blurring of goals, 
which become barriers to effective collaboration. The manifestation of this problem can 
be seen in both the risk management an intelligence communities. The specialization of 
the collection disciplines and analysis disciplines often puts intelligence interests at odds 
or in competition with one another (Lowenthal, 2009). A similar situation exists among 
for risk analysts within the homeland security community (Committee to Review the 
Department of Homeland Security's Approach to Risk Analysis, 2010). Appreciative 
inquiry can also act to reduce over dependence on experts and hierarchy and reduce 
defensive posturing when problems or deficiencies are identified (Barrett & Fry, 2005 pp. 
31-32). This in turn can assist in managing the competition within the intelligence 
community and the risk assessment community and helps foster trust and open 
communication thus reducing barriers associated with rigid structure. 

2. The Cynefin Framework 

The Cynefin framework provides a framework that helps collaborative groups or 
organizations make sense of dynamic and complex issues through group interaction. 
Categorization is not the focus for the Cynefin framework; instead the focus is geared 
towards considering elements of decisions, perspective, conflict, and change. Cynefin 
comes from a Welch word that loosely translates in English to “habitats,” but in this 
context is better understood as, “the multiple affiliations that profoundly influence what 
we [as individuals and organizations] are but of which we can only be partly aware” 

(Lazaroff, 2006, p. 66). Kurtz and Snowden specify that the Cynefin framework lends 
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itself particularly well to collaborative approaches and allowing a sense of shared 
understanding to emerge through group discourse (Kurtz & Snowden, 2003, p. 468). 

The Cynefin approach of social complexity, also known as contingent complexity, 
includes the concepts of unorder and emergence, while adding other concepts to address 
the differences between human systems and biological systems. These additional 
concepts are important for understanding decision making and collaboration and include 
the following: 1) Humans do not base decisions on rules but rather on pattern association 
based on their experience or the group narrative; 2) Humans and by extension 
organizations have multiple personalities that are maintained in parallel and the dominant 
personality depends on situational context; 3) Humans are self-aware, thus making it 
difficult to distinguish accidents from planned actions; and 4) Free will allows humans to 
create order and structure in their interactions (Lazaroff, 2006, p. 70). These factors help 
define perceptions and shape interactions, bias, filters, and perceptions of individuals and 
agencies in collaborative environments. 

The Cynefin framework, illustrated in Figure 9, includes five separate domains 
that are divided into ordered, unordered, and disorder. The ordered domains are situated 
on the right side of the model and include the known causes, effect domain, and the 
knowable cause and effect domain. The unordered domains are situated along the left 
side of the model and include the complex relationship domain and the chaos domain. 
Additionally, the domain of disorder is located in the center of the model. Most people 
and organizations perceive the top right quadrant “knowable” to be the most desirable, 
however, there are no values associated with the domains, so no one is actually better 
than the others. The real value of the model is to facilitate discussion and consensus with 
uncertain conditions (Kurtz & Snowden, 2003, p. 468). 
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Figure 10. The Cynefin Framework from (Kurtz & Snowden, 2003). 


The simplest of the domains is the “ kn own” domain or simple order. The cause 
and effect relationships associated with issues in this quadrant are linear and empirical, 
and are not widely open to dispute or varying interpretations. The self-evident nature of 
the cause and effect relationships lend themselves well to the application of empirically 
determined best practices and hierarchical management structures (Lazaroff, 2006, p. 66). 
The focus in this space is on efficiency where incoming data is sensed, categorized, and 
responded to in accordance with predetermined practices (Kurtz & Snowden, 2003, p. 
468). Many tactical risk management issues fit within this domain. Examples include; 
elevating homes or removing them from floodplains to reduce flood risk or installing 
security fences to limit access as to improve security at a facility. The simple 
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relationships and structured decision models indicative of issues in this domain do not 
lend themselves to collaborative techniques. One could easily see where the structure in 
this domain could stifle collaboration. The collaborative value of identifying issues that 
fit within this domain is it allows the group to focus their efforts on issues within the 
knowable and complex domains. 

The domain of “knowable” or complicated order is closely associated with the 
“known” domain although slightly more complex in nature. The cause and effect 
relationship associated with issues or decisions within this domain do not present 
themselves as self-evident like those in the “known,” but instead require some level of 
expert interpretation (Lazaroff, 2006, p. 67). Kurtz and Snowden explain that the issues 
and decisions within the “knowable” domain can ultimately be moved to the “known” 
domain with the investment of the appropriate time and resources (Kurtz & Snowden, 
2003, p. 468). The decision-making process in this quadrant can be represented by 
sensing data, apply expertise to analyze the data, and then respond accordingly. Tactical 
and operational risk management issues often fit within this domain. 

Homeland security risk management examples in the “knowable” domain may 
include a structural and nonstructural seismic analysis of a building to develop a suite of 
options to improve the seismic performance of a building and options to reduce damage 
to nonstructural components; or a site security assessment to develop an ensemble of 
measures that work in concert to improve the security at a facility. Lazaroff indicates that 
this leads to establishing strong entrained patterns or order that that are subject to 
validation as good practices, not best practices and once established difficult to disrupt 
(Lazaroff, 2006, p. 67). Kurtz and Snowden point out the danger with the entrained 
patterns in which simple errors in assumptions can produce false conclusions that are 
difficult to isolate and detect (Kurtz & Snowden, 2003, pp. 468-469). Collaboration can 
be effective in this domain to provide access to the appropriate expertise, evaluate and 
formulate responses, and track cause and effect relationships. 
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The “complex” or complex unorder domain represents the quadrant that is home 
to the issues and decisions where cause and effect relationships exist, but the number of 
factors and relationship among those factors defy categorization and analytic techniques, 
thus making patterns difficult to define (Kurtz & Snowden, 2003, p. 469). In this sense, 
most of the patterns are only discernable in retrospect. This domain includes more 
strategic homeland security risk management issues, which include examples such as 
effective strategies for floodplain management within an entire watershed or developing 
strategies to promote critical infrastructure resilience that accounts for sector and 
subsector interdependencies. Discovery is the theme of this quadrant as individuals and 
organizations probe to identify patterns then sense and respond by reinforcing the 
positive patterns and destroying the negative patterns (Lazaroff, 2006, p. 67). This space 
demands collaboration in order to gain new and multiple perspectives on issues and 
decisions with narrative techniques (Kurtz & Snowden, 2003, p. 469). This domain 
fosters the sharing and appreciation of the different perspectives that collaborating 
agencies bring to the table and emphasizes qualitative analysis in lieu of quantitative 
analysis. 

The “chaos” or chaotic unorder domain, located in on the lower left portion of the 
Cyncfin model is characterized by turbulence and as the quadrant that is home to the 
issues and decisions where no perceived cause and effect relationship exists. Lazaroff and 
Snowden explain that this domain represents both threat and opportunity depending on if 
the issue is placed within the domain by accident or on purpose. A crisis can bring about 
a sudden, unanticipated, and confusing decent into this quadrant or conversely, a complex 
issue can be moved to this domain to disrupt preexisting patterns and elicit original 
innovative approaches (Lazaroff, 2006, p. 67). The unconventional threat presented by 
terrorism where an intelligent adversary adapts tactics to counter security measures and 
responses provides a good example of a homeland security risk that fits within this 
domain. Another example of a homeland security risk that fits within this domain would 
be an infrastructure failure that creates impacts across many sectors and subsectors for 
reasons that are not understood. 
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The intent of decisions within the “chaos” quadrant is to reduce turbulence 
through quick and decisive action. The nature of action may differ in that authoritarian 
approach offers the opportunity to control the decision space in order to transform the 
issue into the knowable or known domain, while the collaborative approach provides the 
opportunity to examine multiple interventions to construct new patters moving the issue 
to the complex domain (Kurtz & Snowden, 2003, p. 469). Ultimately framing issues in 
this domain can provide a valuable vehicle to break down existing patterns to create 
novel innovative patterns through collaborative work. When using this quadrant to elicit 
collaboration, it is important to resist the autocratic tendencies that result from trying to 
force issues to the knowable or known domains. 

The “disorder” domain is the central domain of the Cynefin Framework and lies 
in the middle between all four other domains. The placement of decisions and issues in 
this domain indicate confusion or uncertainty over which of the other four domains 
applies to the situation. Most individuals and organizations can agree on the meaning of 
the four domains in the context of the issue being considered, however, strong 
disagreement often occurs on the subtle issues that are found near the center of the 
Cynefin Framework. Consequently, competition over the interpretation of how these 
subtle issues fit within the framework is generally driven by the perception and 
preferences of individuals and organizations based on where they feel most comfortable 
and empowered within the framework (Kurtz & Snowden, 2003, p. 470). Lazaroff and 
Snowden point out that the intelligence function largely takes place within this domain, 
and that natural tendency is towards bias interpretation based on personal or agency 
penchants. They describe this action in the following tenns: 

Highly structured thinkers will tend to interpret the data as supporting 
their process to manage simple order; experts will require more time and 
money to analyze the situation; field agents will make multiple small tests 
by actions or questions to see what is possible; and the charismatic tyrants 
will interpret any situation as a crisis so they can be given power to act 
without reference to other authorities. 

(Lazaroff, 2006, p. 67). 
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The conflict and competition inherent to the “disorder” domain provides the 
opportunity for bias that needs to be accounted for when undertaking collaborative 
analysis and decision-making activities. 

3. Principles for Strategic Collaboration and Planning 

The complex risk analysis and management issues coupled with the multiple 
stakeholders from different tiers of government and the private sector require significant 
attention to principles of strategic planning and communication for agencies to come 
together in a collaborative effort. The “success” factors for collaboration and conceptual 
models like the Cynefin framework cannot create collaboration without strategy, 
innovation, communication and leadership. These concepts are interrelated, and together 
provide the essential elements for collaboration to occur. 

Strategic collaboration for homeland security includes a number of environmental 
factors that influence the potential success of collaborative efforts, and the leaders and 
managers forging collaborative relationships need to focus their efforts on those factors 
they can control. While managers may not be able to control institutional support for 
collaboration, they can likely control factors such as planning, conflict management, 
stakeholder participation and empowerment, and the governance structure for a 
collaborative organization (Bryson, Crosby, & Stone, 2006, p. 52). These factors within 
the managerial sphere of influence align with the five dimensions described by 
Thompson and Perry and within the “success” and “barrier” factors offered by Hocevar, 
Thomas, and Jansen. Leaders and managers play an important role in facilitating 
collaboration though these factors, which generally fit within the structure, lateral 
mechanisms, and people components (Hocevar, S. P., Thomas, G. F., & Jansen, E., 2006) 
and the five dimensions of governance, administration, autonomy, mutuality, and trust 
and reciprocity (Thomson & Perry, 2006). 

Planning plays an important role in developing productive and successful cross¬ 
sector collaborative endeavors. Cross-sector collaboration tends to succeed when both 
deliberate and emergent planning are incorporated into the collaborative planning 
process. Deliberative planning provides a traditional structured approach to establishing 
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goals, objectives, milestones and responsibilities, and emergent planning is less 
structured and occurs over a period of time as a relationship develops through 
conversation and the inclusion of social networks (Bryson, Crosby, & Stone, 2006 p. 48). 
Both approaches to planning address a different aspect of collaborative success factors. 
The deliberate planning approach comports with the success factors the purpose and 
strategy and structure components while the emergent approach to planning focuses on 
the success factors associated with lateral mechanisms and incentives. Deliberate 
planning works best where collaboration is required, such as among departments within 
an organization, and the lateral relationships inherent to collaborative networks lend 
themselves to the emergent planning approach (Bryson, Crosby, & Stone, 2006, p. 48). 
The combination of approaches remains important to collaboration because lateral 
networks do not replace organizational hierarchy, instead the hierarchical framework 
should be considered an overlay to the collaborative network. This is an important 
consideration, since most organizational managers continue to perform the bulk of their 
work within their organizational hierarchy (Agranoff, 2006, p. 57). 

Greater success of collaborative endeavors occurs when the planning includes the 
perspectives and interests from all stakeholders. The author, Gerald Harris, applies 
concepts borrowed from quantum physics that support this premise. A key idea he relates 
applies directly to how organizations can plan for collaboration. Harris describes this idea 
as “catalytic and kaleidoscopic thinking” in which the concept that two simultaneous 
observations from different positions can produce two distinctly different observations 
that are both accurate and true (Harris, 2009, p. 75). In this sense, he promotes the 
importance of different points of view in the both collaboration and strategic planning. 
This concept comports with the “success” factors within the incentives and people 
organizational components described by Hocevar, Thomas, and Jansen. Additionally, this 
notion is supported by the observation that collaboration is often sought when 
independent attempts to address an issue or solve a problem have failed or are likely to do 
so, and these failures cannot be overcome by acting alone (Bryson, Crosby, & Stone, 
2006, p. 46). 
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Large, complex, or “wicked” problems present the greatest challenges to 
organizations while at the same time provide the greatest opportunity for collaborative 
solutions. Cross-sector collaborations, meaning partnerships among governmental and 
private organizations, tend to form during periods of turbulence and uncertainty centered 
on complex problems (Bryson, Crosby, & Stone, 2006, p. 46). Organizations should 
embrace the notion that uncertainty cannot be escaped, and that it can provide an 
opportunity for collaboration. Harris equates the quantum physics concept that it is 
impossible to know both the position and speed of an electron to uncertainty in the sense 
of strategic planning (Harris, 2009, p. 43). In this sense, analysis should be viewed as a 
work in progress because there is always something else to learn and add to the body of 
knowledge. In the same respect, collaboration within the complex and chaos domains of 
the Cynefin network should be embraced to further analysis of complex issues and 
problems. 

Collaboration by its nature expands the realm of possibilities, and thus 
organizations must be willing to explore and accept a broader range of possibilities than 
they had initially envisioned. This view is supported by association with “success” 
factors for collaboration to include an appreciation for the perspectives of others and 
acknowledging the benefits of collaboration (Hocevar, S. P., Thomas, G. F., & Jansen, E., 
2006, p. 8). From a strategic planning perspective, two concepts highlighted by Harris 
apply to opening up to a wider range of possibilities. The first encourages organizations 
to go beyond dualistic thinking, in other words, avoid good/bad or either/or 
characterizations and encourage learning with more inclusive approaches to thought and 
examination (Harris, 2009, p. 33). The second is accept that organizations, issues, and 
problems are interconnected in one space, and so changes to any component within that 
space create second and third order effects that ripple throughout the whole environment 
(Harris, 2009, p. 85). The known and knowable domains within the Cynefin Framework 
provide comfort in the sense that uncertainty is limited. However, too much focus by 
organizations in these two domains limits collaboration through a failure to explore 
alternate possibilities, which in turn can lead to arrogance and a false sense of complete 
understanding. 
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E. OVERCOMING OBSTACLES AND CHALLENGES TO 

COLLABORATION 

The focus of attention should not be limited to those enabling situations and 
“success” factors. The understanding and effective management of “barrier” factors must 
also garner attention, if collaborative action is going to be successful. The act of 
recognizing these obstacles to collaboration, and then taking the appropriate action to 
minimize their influence, provides the best avenue to encourage collaboration among 
agencies with different agendas and priorities. 

Establishing mutual trust among organizations in situations where collaboration is 
desired holds a place of paramount importance and can present a fonnidable barrier if not 
managed appropriately. When organizations initiate overtures of collaboration, they 
should be mindful that reputations and prior relationships play a significant role in 
establishing trust. Partnering organizations often base their judgments of organizational 
trustworthiness and legitimacy on prior relationships and networks (Bryson, Crosby, & 
Stone, 2006, p. 46). Hocevar, Thomas, and Jansen specifically identify organizational- 
level distrust as a barrier “factor”, and several other barrier factors they identify also 
influence the degree of “trust” or “distrust” such as; competency, arrogance, hostility, 
animosity, territorial tendencies, inadequate communication and infonnation sharing, and 
competition for scarce resources (Hocevar, S. P., Thomas, G. F., & Jansen, E., 2006, p. 
8). Research shows that trust not only plays an important role in facilitating collaboration 
at the start, but that it plays an important role in holding the collaborative group together, 
and should be seen as an on-going requirement for maintaining effective partnerships in 
collaborative efforts (Bryson, Crosby, & Stone, 2006, pp. 47-48). 

Conflict between organizational self-interest and collective interest can undermine 
efforts to build and maintain trust among partners in collaborative organizations if 
overlooked. Thompson and Perry identify and describe this natural strain that is the result 
of a dual identity in that organizations involved in collaborative action possess both 
interests inherent to the specific organization and interests of the collective group, which 
can be at odds with one another (Thomson & Perry, 2006, p. 26). Effective management 
of this strife is essential for collaborative success. This can be accomplished through 
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deliberative and emergent planning processes to equalize power within the group through 
utilization of stakeholder analyses and responding effectively to the input from primary 
constituent groups (Bryson, Crosby, & Stone, 2006, p. 48). This builds trust by 
facilitating communication and valuing the perspectives of other organizations in the 
group that are identified as “success’ factors for collaboration by Hocevar, Thomas, and 
Jansen. 

In his book, The Speed of Trust, Stephen Covey identifies three key ideas to 
improving intent and thereby facilitating stronger communication and hence enabling the 
building of trust. These three concepts are: examination and refinement of motives, 
clearly stating intent, and to embrace and choose abundance (Covey, 2006, pp. 85-90). 
First, organizations should regularly evaluate their mission, goals, objectives, and plans 
to maintain a firm understanding of their motives so that they can be communicated with 
transparency. Accomplishing this first step allows organizations to clearly state their 
intentions to the other organizations involved in the collaborative endeavor. Finally, the 
organization should make a conscious choice to view the situation with an emphasis 
toward abundance instead of scarcity. Covey points out, in most every situation, 
abundance is a reality that can produce even more (Covey, 2006, p. 88). This third idea 
applied to interagency collaboration suggests that there is an abundance of talent, 
prestige, recognition, and potentially resources to accomplish the work, if collaborating 
organizations employ genuine communication to make their intent transparent to build 
the required trust among partners. 

F. DECISION MAKING IN A COLLABORATIVE CONTEXT 

Deliberate and emergent planning can help alleviate trouble with decision making 
in collaborative environments; however, several other factors need to be considered to 
promote trust among collaborating organizations. The governance and administrative 
dimensions described by Thompson and Perry emphasize the structure components 
necessary for decision making in a collaborative environment. The authority of agency 
representatives to make decisions on behalf of their agencies is an important aspect for 
success in the structural and administrative aspect of collaboration (Hocevar, S. P., 

Thomas, G. F., & Jansen, E., 2006, p. 8). However, several other factors significantly 
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influence decision making in collaborative environments, and distinct differences exist 
between public sector organizations and private sector organizations relative to 
collaborative decision making. 

Networks and interdependent relationships inherent to collaboration contain 
power bases that provide significant influence over the decision-making process. 
Collaborative networks do alter the perceived public and private boundaries to a certain 
degree; however, these networks are incapable of replacing public bureaucracy 
(Agranoff, 2006, p. 62). While research demonstrates private sector participation in 
collaboration influences public sector decision making, it is also clear that public sector 
institutions and administrators make and implement decisions in the public domain. 
Supplying perfonnance and intelligence data represents one way in which private sector 
can influence decision making in public-private collaborative efforts. The availability of 
data and intelligence based on data analysis is not as great in the public sector as in the 
private sector (Nutt, 2006, p. 292). The competition inherent to private sector 
organizations relies on analysis of large amounts of data, and thus the private sector has a 
vested interest in gathering and maintaining large data sets. The manner in which the data 
and analysis from the private sector is presented can influence how it is interpreted and 
how a decision is made. This concept is described as “choice architecture” in the book, 
Nudge, in which the authors argue that there is no neutral design (Thaler, R. H. & 
Sunstein, C. ., 2009, .p 6). 

Robert Arangoff describes four types of power that coexist with the legitimate 
power vested in the governance and structure components; these elements of power 
include; a champion, political core, technical core, and support staff. The power 
associated with the role of the “champion” comes from the visibility and prestige this 
person or organization lends to the group, which encourages partners to stay and find a 
way to cooperate (Agranoff, 2006, p. 61). This relates to the important use of social 
capital as a lateral mechanism (Hocevar, S. P., Thomas, G. F., & Jansen, E., 2006, p. 17). 
The “political core” includes agency leaders who often serve on governance boards, and 
their legitimate power, control of resources, and support or lack thereof, conveys the 
importance or insignificance of the collaborative endeavor (Agranoff, 2006, p. 61). This 
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type of power and influence relates directly with the structure and purpose and strategy 
components of collaboration described by Hocevar, Thomas, and Jansen. 

Significant differences exist between private and public sector organizations 
relative to the political influence on decision making. Private sector organizations tend to 
receive the greatest political influence indirectly from internal sources, where political 
influence on public sector organizations comes from authority vested in the network and 
users, which ultimately demands more time to balance the needs presented by oversight 
bodies (Nutt, 2006). The “technical core” often represents workgroups or specific 
disciplines and draw upon expert power related to narrowly focus superior knowledge of 
a particular subject matter (Agranoff, 2006, p. 62). The support staff of collaborative 
groups exercises power in both a formal and informal manner by taking care of the 
administrative needs to keep the organization intact and moving towards the identified 
goals and objectives. 

The concept of risk also plays a significant role in decision making for both 
individuals and collaborative groups. Several factors such as trust, control, choice, 
familiarity, and categorization of risks influence perception of risk. Individuals and 
groups are more likely to trust assessments of risk in which either they were directly 
involved or where they had the opportunity to offer comments (Ropeik, 2010, pp. 70-80). 
Collaborative groups provide an opportunity to share or distribute risk among partners 
(Thomson & Perry, 2006). 

The influence of risk in decision making differs between public and private sector 

organizations. The relevance of this fact relates to the perception and treatment of risk in 

making decisions in collaboration that involves both public and private sector 

organizations. Private sector organizations tend to make decisions based on internal data 

analysis and speculation, which they view as less risky, juxtaposed to the public sector 

that tend to use a consultative and networking approach that they perceived to carry less 

risk (Nutt, 2006, pp. 298-299). The speculation aspect of decision making in private 

sector organizations is similar to the concept of “anchoring.” Anchoring is a process 

where there is a known factor and reasonable adjustments are factored in to estimate an 

unknown factor (Thaler, R. H. & Sunstein, C. R., 2009, p. 22). Private sector 
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organizations perceive greater risk from collaboration than public sector organizations, 
and public sector organization perceive greater risk with independent analysis and 
speculation. The differences in risk perception between the public and private sector can 
create friction if not accounted for and managed appropriately, and could be seen as a 
point of strength by creating balance between the two approaches. Additionally, public 
sector organizations are more adverse to the potential for controversial decisions than 
private sector organizations, and public sector organization tend to perceive less risk than 
private sector organizations when facing comparable decisions (Nutt, 2006, p. 299). 

The presentation of risk information also influences the perception and ultimately 
decisions of people and organizations in a collaborative group. How people and 
organizations view and think about things depends largely on how they are framed by 
both those presenting the information and those receiving the infonnation (Ropeik, 
2010). Thaler and Sunstein describe three heuristics that help people and organizations 
frame decisions. These include “anchoring,” described above, “availability” in which risk 
is perceived based on how quickly similar examples can be recalled, and 
“representativeness” in which comparisons like stereotypes are used to estimate 
likelihood (Thaler, R. H. & Sunstein, C. R., 2009, pp. 24-31). Along with these 
heuristics, perception of probability, optimism bias, value described as the endowment 
effect, and that most people find it difficult to work with and understand numbers can 
skew sensitivity to real or perceived risk (Ropeik, 2010). 

G. OBSERVATIONS AND SUMMARY 

Many factors influence the success or failure of collaboration. The homeland 
security enterprise requires agencies from multiple tiers of government and private sector 
organizations to collaborate. The significant differences between decision making 
between public sector and private sector organizations, and their perceptions of risk 
described by Nutt, can provide a source of strength through balance, however, these 
differences can also create tension among the partner entities. Tension between partners 
can create or exacerbate conditions that are identified as “barriers” by Hocevar, Thomas, 
and Jansen. 
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Although federalism should be viewed as a collaborative effort among the federal 
government and the state and territorial governments, old tensions between the federal 
government and state governments persist. The shift of power to the federal government 
following the terrorist attacks of 9/11 significantly adds to this tension and is fueled by 
inadequate communication and coordination of information, organizational distrust, 
competition for resources, and arrogance. These issues directly align with “barrier” 
factors identified by Hocevar, Thomas, and Jansen. These barrier factors must be 
addressed, if an effective level of homeland security collaboration between the federal 
government and state governments is to be achieved. 

The Cynefin framework provides a vehicle to enable strategic thought towards 
collaborative endeavors, and coupled with strategic planning principles, could improve 
collaborative efforts between public and private sector partners involved in the homeland 
security enterprise. Significant homeland security issues typically fit within the complex 
or chaos domain of the Cynefin framework. Additionally, collaboration comports most 
readily with the complex and chaos domains as well. The framing of homeland security 
issues, such as risk analysis and management in this manner, can be leveraged to improve 
collaboration among the multiple partners involved. The goal of moving issues from the 
chaos and complex domains to the knowable and known domains within the Cynefin 
framework can help facilitate collaboration by aiding in defining purpose and strategy 
and creating structure. 
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V. CONCLUSION AND RECOMMENDATIONS 


Risk management within the homeland security enterprise remains too diverse 
and interdependent to succeed without effective collaboration between disciplines and 
tiers of government. The risks considered by the homeland security enterprise include 
catastrophic natural disasters, man-made hazards, and acts of terrorism (National Strategy 
for Homeland Security: October 2007 .p 2). The observations and findings related to 
intelligence and homeland security risk management discovered in this thesis fit within 
one of the three domains of the Inter-Organizational Collaborative Capacity (ICC) Model 
from Hocevar, Thomas and Jansen. These three domains include purpose and strategy, 
structure, and lateral mechanisms. The domains of incentives and people tend to apply 
more directly to the individual within organizations and thus fall outside the focus of this 
thesis. 

A. PURPOSE AND STRATEGY 

A successful model for collaboration for homeland security risk management 
must begin with a common purpose and strategy that establishes the foundation to unify 
effort among a wide dichotomy of interests and stakeholders. Several factors influence 
the ability to develop a common purpose and strategy, such as recognize 
interdependencies and common interests among organizations, adaptability to the 
interests and priorities of other organizations, and the sense of a need to collaborate as the 
issue at hand is too large and complex to handle alone (Hocevar, S. P., Thomas, G.,F., & 
Jansen, E., 2006). This step also supports a strategic approach by communicating 
intentions, planned actions, and perceptions of reality. This communication enables 
dialog on core beliefs, assumptions, and values to ensure organization priorities, goals, 
and objectives remain true and grounded (Harris, 2009). The following conclusions fit 
within the purpose and strategy domain of collaboration. 
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Homeland security strategy and guidance documents identify risk management as an 
important concept central to all areas of the homeland security enterprise. 

Risk management remains a central theme and point of emphasis for strategy and 
guidance documents throughout the homeland security enterprise. The National 
Infrastructure Protection Plan (NIPP) identifies its risk management framework as the 
cornerstone of the entire infrastructure protection strategy (National Infrastructure 
Protection Plan, 2009, p. 27). The Homeland Security Strategy acknowledges that risk 
management transcends all aspects of homeland security and factors significantly into 
resource allocation decisions for the elimination, mitigation, and control of risks (National 
Strategy’ for Homeland Security’: October 200 ,7 .p 41). Risk management concepts constitute 
the basis for state and local all-hazard mitigation plans, which includes a strategic 
planning process, risk identification and assessment, development of mitigation 
strategies, and a review process to monitor progress towards risk reduction (Federal 
Emergency Management Agency (FEMA), 2007). The fiscal year 2011 grant guidance 
from FEMA for the Homeland Security Grant Program (HSGP) includes developing a 
Threat Hazard Identification and Risk Assessment (THIRA) as the first objective under 
the first priority to advance the whole of community approach to emergency management 
and homeland security. The development or improvement of the THIRA will support risk 
management activities through strategy development, planning activities, investment 
justifications, and capability gap analysis (U.S. Department of Homeland Security, 
2011b). This emphasis also appears in the 2011 guidance for the Emergency Management 
Performance Grant (U.S. Department of Homeland Security, 2011a). 

Homeland security strategy documents acknowledge that partnerships and 
collaboration among public and private stakeholders from all levels of government are 
required to be effective in managing risks. 

Without exception, all homeland security strategy documents reviewed for this 
thesis recognize that the understanding and management of homeland security risks is far 
too immense for any one organization or tier of government to accomplish alone. This 
common theme among the various homeland security strategy and guidance documents is 

reflected in this statement from the National Strategy for Homeland Security: 
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Throughout the evolution of our homeland security paradigm, one feature 
most essential to our success has endured: the notion that homeland 
security is a shared responsibility built upon a foundation of partnerships. 
Federal, State, local, and Tribal governments, the private and non-profit 
sectors, communities, and individual citizens all share common goals and 
responsibilities - as well as accountability - for protecting and defending 
the Homeland 

(.National Strategy for Homeland Security: October 2007, p. 4). 

This theme is further echoed by the first strategic theme “Broader Collaborative 
Partnerships” from the NEMA white paper that outlines recommendations for a national 
mitigation effort (NEMA, 2009). 


The U.S. Department of Homeland Security has made significant progress in their 
efforts to improve risk management and secure its position as core element of the 
homeland security culture, however significant work remains. 

DHS made significant steps towards improving the risk management culture 
within the homeland security enterprise with the publication and update to the DHS Risk 
Lexicon and the Risk Management Fundamentals: Homeland Security risk Management 
Doctrine 2011. The importance of the DHS Risk Lexicon in advancing the risk 
management culture within homeland security is best summarized in a statement from 
Undersecretary Rand Beers in the preface. Mr. Beers states, 

Clear and unambiguous communication among homeland security risk 
practitioners, decision makers, and stakeholders is necessary to achieve 
integrated risk management. The DHS Risk Lexicon supports integrated 
risk management by defining a single language for risk management and 
analysis. The DHS Risk Lexicon makes available an official set of 
hannonized risk-related terms and definitions. 

(United States. Department of Homeland Security (DHS), 2010). 

The homeland security risk management doctrine provides an authoritative on the 
principles and processes for homeland security risk management and provides the 
foundation for risk management partnerships throughout the homeland security enterprise 
(United States Department of Homeland Security (DHS), 2011). 
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Even with this, notable progress by DHS additional work remains. These 
documents are still relatively new and do not have the familiarity or the number of users 
that other strategic level documents within the homeland security enterprise do. FEMA’s 
guidance for state and local mitigation planning was published the same year as the initial 
version of the DHS Risk Lexicon; however, it makes no references to the DHS Risk 
Lexicon (Federal Emergency Management Agency (FEMA), 2007). The absence of 
references to the DHS Risk Lexicon in guidance and strategy document marginalizes it 
utility, and consequently is remains largely unknown and lightly employed by state and 
local governments. Curiously, state and local governments are left out as a primary 
audience for the DHS Risk Management Doctrine, but the document does include a note 
indicating that these levels of government may find the information useful (United States 
Department of Homeland Security (DHS), 2011 pp 6). 

B. STRUCTURE 

Structure builds on the common purpose and strategy to enable willing 
organizations to collaborate on issues of shared interest. Organizational design, 
flexibility, metrics and individual support of collaborative efforts are key aspects of this 
collaborative domain (Hocevar, S. P., Jansen, E., & Thomas, G. F., 2011, p. 3). The 
influence of this domain significantly influences the degree of success of homeland 
security risk management collaborative efforts. The following conclusions pertain 
specifically to the structure domain of collaboration. 

The existing centralization of homeland security risk management at the federal 
level of government limits collaboration and stifles strategic risk management within 
state and local government. 

A strong hierarchical organizational structure with centralized power and decision 
making presents more barriers to effective collaboration than a decentralized approach, 
and thus centralization of homeland security risk management within DHS remains less 
effective than decentralizing risk management to state governments and multi-state 
regional networks. Collaborative endeavors are more difficult to implement across 
hierarchical organizations (Thomson & Perry, 2006). The focus of the hierarchical 
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homeland security structure at the federal level appears to be focused on controlling the 
homeland security priorities and activities of state and local governments instead of 
seeking their input for developing strategies to manage homeland security risk. DHS 
authorities told state and local officials they would be actively consulted, but evidence 
has proven that top-down direction and large amounts of federal funding are used to steer 
state and local governments marginalizing any shared decision making and leaving little 
room for independent action and initiative (Edwards, 2007, p. 33). 

The existing hierarchical structure of homeland security is more focused on 
metrics related to grant spending than metrics associated with risk management. Instead 
of managing homeland security risk, the existing hierarchical homeland security 
apparatus is designed to create and follow rules and to spend money through federal grant 
programs (Bellavita, 2005). DHS employs risk assessment in determining the allocation 
of homeland security grant funds to state and local governments. The existing risk-based 
grant methodology ignores vulnerability essentially communicating that all states are 
equally vulnerable (Government Accountability Office (GAO), 2008, p. 4). This negates 
the concept of applying risk management practices to inform decisions and apply limited 
resources to address the most significant risks identified by state and local partners. 

The homeland security enterprise includes a series of grant driven metrics that 
provide the basis for collaboration on homeland security issues between state and local 
governments and the federal government. Homeland security grant programs to state and 
local governments provide the basis for collaboration in the homeland security domain, 
and the compliance requirements for these programs demonstrate a complete lack of 
awareness and sensitivity to homeland security management priorities and the operational 
activities of state and local governments (Clovis, 2006). These conditions promote 
divergent goals between state and local governments, and those of the federal 
government; show disinterest on behalf of the federal government in adapting to the 
interests of state and local governments; stimulate competition among states for scarce 
resources; and impose highly structured rules and policies that impede collaboration. All 
of these conditions align with those identified as barriers to collaboration (Hocevar, S. P., 
Thomas, G. F., & Jansen, E., 2006). 
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The fusion of the intelligence cycle and risk management process to enable 
intelligence-led risk management will benefit both the risk management and 
intelligence disciplines. 

Capitalizing on the similarities between the intelligence cycle and the risk 
management process by combining these models will enhance collaboration between the 
intelligence and risk management communities resulting in an intelligence-led approach 
to risk management. The need to improve cross-discipline familiarity between the 
intelligence and risk management disciplines has been identified and DHS should take 
steps to address this need through education, training, exchanges, liaison, and 
transparency (Baker et ah, 2009). The fusing of the intelligence cycle and risk 
management process will significantly advance efforts to improve familiarity by 
providing a common frame for training and education, improving existing linkages for 
liaisons to exploit while increasing transparency between the two disciplines. 

The risk analysis and assessment provide some tools and concepts that can assist 
the intelligence community improve their conclusions, and thus their support of 
homeland security risk management. Risk analysis plays a central role in identifying 
scenarios and issues of greatest concern for risk management. This infonnation also aids 
intelligence analysts to concentrate their efforts on producing assessments for the 
scenarios of greatest concern and directing future collection efforts to refine and improve 
these (Willis, 2007, p. 14). This fits with the idea that intelligence collectors need to be 
acutely aware of the daily needs of their customers and working in the spaces of their 
customers to develop a better contextual understanding of their intelligence needs (Steele, 
2002 pp. 154-155). The intelligence-led mitigation approach supports a shift from a 
supply and demand relationship towards a mutually beneficial relationship that 
emphasizes shared learning. This shift promotes collaboration and improves the quality 
of threat assessments (Baker et ah, 2009, p. 9). 
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State and major urban area fusion centers provide the best vehicle to implement 
intelligence-led risk management to promote the construction of a realistic national 
homeland security risk management strategy in which state and local governments are 
equal partners with the federal government. 

State and major urban area fusion centers are designed and structured to meet the 
intelligence needs of the governments they serve. This reality gives them the unique 
perspective of being closer and more directly invested with the state and local risk 
management priorities and connectivity to local information sources to support more 
accurate threat assessments. DHS offers baseline capabilities intended to support the 
design and intelligence operations of fusion centers to address common needs of the 
governments they support. While the baseline capabilities offered by DHS provide for 
some consistency, the state and local governments who own and operate the fusion 
centers, structure them and prioritize their tasks to meet their unique needs and challenges 
(United States. Department of Homeland Security, 2008). Mayors and Governors can 
leverage these fusion centers to provide the necessary intelligence relevant to supporting 
their risk management decisions (Chen, 2009). 

The U.S. Coast Guard’s Maritime Security Risk Analysis Model (MSRAM) 
demonstrates how effective this decentralized approach can be. The MSRAM process 
provides continuous collaborative interaction between national intelligence analysts and 
local stakeholders who provide locally available unclassified information (Baker et ah, 
2009, p. 66). The direct continuous interaction between the intelligence analysts and 
those charged with managing risk within state and local government that the MSRAM 
process provides is similar to the relationship fusion centers share with the governments 
they support. State and local fusion centers provide the conduit connecting the national 
intelligence community with the analysts and infonnation available within state and local 
governments to support the all-hazards all-threats risk management information needs of 
mayors and governors (Steiner, 2009, p. 2). The MSRAM process puts a premium on the 
information and interaction with state and local officials and provides a vehicle to support 
local operational and tactical risk management objectives while rolling the infonnation 
up to the national level to support strategic risk management decisions (Baker et al., 2009 
pp. 66-67). 
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Decentralization of intelligence support for risk management through the network 
of state and local fusion centers will improve the quality of both intelligence and risk 
assessments while fostering greater collaboration between the intelligence community 
and risk management community. A statement from the author, Robert D. Steele, 
captures the spirit of this idea. He wrote, “Above all, having the distributed network in 
place, with trusted relationships and pre-approved access, becomes more important than 

any sort of central intelligence organization.we still need a national intelligence 

agency, but it should be at the center of a distributed network.” (Steele, 2002, p. 153) 

The Cynefin Framework provides a strategic thinking tool to enable the structural 
flexibility needed for the dynamic reality of homeland security risk management 

Risk management for the homeland security enterprise is a complex adaptive 
system comprised of many organizations across multiple tiers of government and the 
private sector working together to manage a multitude of diverse risks. The U.S. 
homeland security enterprise is filled with competing requirements, interests, goals, and 
objectives with threats spanning acts of terrorism, malicious cyber activity, pandemics, 
transnational crime, and natural disasters (United States Department of Homeland 
Security (DHS), 2011). This complex environment includes multiple interdependencies 
that add to the intricacy of managing homeland security risk (.National Infrastructure 
Protection Plan, 2009). The concept of homeland security enterprise describes to the 
collective efforts and shared responsibilities of all tiers of government, nongovernmental 
and private sector partners to develop and maintain the capabilities necessary to manage 
these risks (United States. Department of Homeland Security, 2010, p. 12). 

The unordered domains of complex relationships and chaos within the Cynefin 
Framework provide a useful medium to examine the intricate nature of risk management 
relationships in the homeland security enterprise. The homeland security environment 
includes many dynamics, which include new and emerging technology in the creation of 
new relationships and interdependencies and asymmetrical threats from intelligent 
adversaries. Risk analysis is generally based on expert opinion that is rooted in 
historically stable patterns, such as statistical analysis for determining flood risk. This 
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traditional approach does not enable the stakeholders involved with risk management to 
recognize and adapt to unexpected patterns such as one expects to find associated with 
the dynamic environment with homeland security risk (Kurtz, C.,F. & Snowden, D.,J., 
2003, p. 469). Probabilities and vulnerabilities are closely associated with recognized 
patterns for the purpose of risk analysis (Committee to Review the Department of 
Homeland Security's Approach to Risk Analysis, 2010). In contrast, the complex 
relationship quadrant in the Cynelin Framework creates probes to make alternate patterns 
and potential patterns more visible to gain multiple perspectives to the issue being 
examined (Kurtz, C. F. & Snowden, D. J., 2003, p. 469). These multiple perspectives 
provide a larger spectrum of expert opinion that is critical for understanding complex 
relationships, such as those found within homeland security risk management. The chaos 
environment within the Cynelin Framework also provides a workspace that can be 
utilized to explore new possibilities and create the conditions necessary for innovation 
(Kurtz, C. F. & Snowden, D. J., 2003, p. 469). Learning to accept and leverage chaos is 
required where creativity is valuable in solving complex problems like one expects within 
the domain of homeland security risk management (Brafman, Ori & Beckstrom, Rod, A., 
2007, p. 203). 

C. LATERAL MECHANISMS 

Lateral mechanisms represent and important aspect of collaboration within the 
homeland security enterprise that must be considered and employed in efforts to advance 
intelligence and risk management activities. They refer to the social networks that exist 
between individuals in an organization and those in other organizations thus creating 
formal and informal li nk s between organizations (Hocevar, S. P., Jansen, E., & Thomas, 
G. F., 2011, p. 3). The following findings pertain to ways in which lateral mechanisms 
can be leveraged to improve collaboration in the intelligence and risk management 
aspects of homeland security. 
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State and major urban area fusion centers provide an effective mechanism to 
employ collaborative tools and technologies , promote information sharing, and 
facilitate collaborative learning to advance intelligence and risk management 
activities. 

State and major urban area fusion centers remain a focal point for developing a 
“trusted” relationship for exchanging intelligence and risk information between the 
federal government and state and local governments. The rise of fusion centers after the 
terrorist attacks of 9/11 indicate a recognition that nontraditional actors, such as state and 
local law enforcement and public safety organizations have an important role to play in 
the homeland security mission (Masse, Todd., Rollins, John., 2007). This 
acknowledgement begins the process to establish trust between the intelligence 
community and state and local personnel associated with fusion centers. The building of 
trust through social networking among state and local fusion centers and the intelligence 
community was further advanced by Presidential order in 2005. The 2005 memorandum 
from the president specified that state and local governments must be treated as full and 
trusted partners with the federal government in efforts to combat terrorism (United States 
Department of Homeland Security, 2008, pp. 2-3). This position is further strengthened 
by the National Strategy for Information Sharing which emphasizes a trusted national 
information sharing capability through an integrated network of state and major urban 
area fusion centers (. National Strategy for Information Sharing: Success and Challenges 
in Improving Terrorism-Related Information Sharing, 2007). The evolution of this new 
dynamic between local and state governments and federal agencies continues to show the 
growth of trust. The Director of National Intelligence’s new strategy, “ Strategic Intent for 
Information Sharing” includes language referring to state and local governments as 
trusted partners with interests and responsibilities for optimizing intelligence and 
information sharing in a responsible manner ( United States Intelligence Community 
Strategic Intent for Information Sharing, 2011). 

State and major urban area fusion centers demonstrate the effectiveness of lateral 

mechanisms to facilitate collaborative intelligence work and risk management efforts. 

These fusion centers were created with the purpose of facilitating a trusted exchange of 

information between the intelligence community and state and local government. Fusion 
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centers provide an environment where local, state, and federal public safety personnel 
and law enforcement intelligence analysts are collocated together on common issues 
(United States Department of Homeland Security, 2008). The fusion centers provide a 
venue for continuous interaction between local, state, and federal partners from both the 
intelligence and risk analysis communities. The continuous interaction builds social 
capital and facilitates effective communication and technical interoperability which are 
enabling factors for successful collaboration (Hocevar, S. P., Thomas, G. F., & Jansen, 
E., 2006, p. 8). This continuous interaction is shown to provide the best communication 
and collaboration between intelligence and risk analysts and yields the greatest incentives 
for marinating trust and an effective working relationship (Baker et ah, 2009, pp. 24-26). 

A state driven comparative risk ranking model can be the vehicle to employ lateral 
mechanisms to advance homeland security risk management. 

A comparative risk ranking and management model provides a mechanism to 
employ lateral mechanisms effectively to promote collaboration for homeland security 
risk management. Given the wide spectrum of risks associated with the homeland 
security domain, they must first be grouped into categories and common attributes 
identified. Comparative risk ranking promotes the effective exchange of information and 
transparency by using select common attributes as a point of comparison among 
seemingly divergent risks (Morgan et ah, 2000, p. 49). A comparative approach to risk 
management promotes an open dialog among all stakeholders, which is a key element of 
NEMA’s recommendations for a national mitigation strategy (NEMA, 2009, p. 4). 

Social capital plays an important role in the comparative risk management 
process. The comparative dialog in comparative risk ranking emphasizes value judgments 
from the experts and panelists involved in the process (Morgan et ah, 2000, p. 52). The 
importance of broad collaborative networks and full spectrum community-to-federal 
emphasis in a national risk management strategy promotes shared learning about risks 
and results in a stronger risk management strategy (NEMA, 2009). State and local hazard 
mitigation planning prescribes an inclusive comparative risk ranking approach to 
establish mitigation priorities (Federal Emergency Management Agency (FEMA), 2007). 
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The all-hazard mitigation planning efforts undertaken by state and local governments 
demonstrate how a comparative risk management process can produce effective long¬ 
term risk management strategies (Berke, P, Smith, G, and Lyles, W, 2009). 

D. RECOMMENDATIONS 

1. Decentralize homeland security risk management, and clearly define 
the roles of the private sector and local, state, and federal government 
agencies in the homeland security risk management framework. 

Decentralization of homeland security risk management will change the risk 
management paradigm within homeland security. In lieu of a prescriptive top down 
approach, risk management should be accomplished by building the strategy from the 
bottom up. The decentralized approach can be seen as a mosaic, which is constructed 
from multiple pieces from state and local governments and federal agencies. This 
national mosaic should be constructed from regional pieces, which are made from state 
and federal agency risk assessments and management strategies. 

While DHS and other federal agencies must continue to develop risk management 
strategies for risks outside our borders and for their statutory responsibilities, DHS must 
focus its risk management efforts on producing guidance and assessment tools and 
techniques for state and local government. Additionally, DHS should support state and 
local efforts by leveraging national laboratories and technical experts for risk assessment 
activities. 

The decentralized approach to risk management needs to provide generalized 
goals through federal guidance without being prescriptive. This will afford state and local 
governments to establish their own goals within this frame. Decentralization also enables 
state and local government to effectively employ lateral mechanisms to facilitate a 
collaborative effort for risk management. 
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2. Improve the coordination and collaboration between the intelligence 
community and risk analysts to advance homeland security risk 
management efforts. 

Intelligence contributions are an important aspect of homeland security risk 
analysis. Efforts to improve collaboration between intelligence and risk analysis will 
significantly improve the quality of assessments for homeland security risk management. 
The U.S. Coast Guard’s Maritime Security Risk Analysis Model (MSRAM) provides a 
good model of collaboration between intelligence and risk analysis to emulate. State and 
local fusion centers provide a vehicle for state and local governments to leverage in 
improving collaborative relationships between intelligence and risk analysis in a 
decentralized homeland security risk management framework. 

State and regional fusion centers provide one possible component of a 
collaborative model for risk management. However, most of the fusion centers are still in 
their infancy with significant work remaining to mature in all-risk management. While 
fusion centers may be part of the solution, their ability to advance strategic risk 
management also depends on a larger collaborative framework to promote infonnation 
sharing, best practices, and guide homeland security risk management for all risks. 

3. Employ a comparative risk ranking and management model to 
support strategic risk management throughout the homeland 
enterprise. 

A comparative risk ranking and management model similar to the Carnegie 
Mellon Risk Ranking Model would help state and local governments with comparing a 
diverse spectrum of risk as part of their risk management process. Comparison of risk 
attributes allows different risks to be compared in a standard framework. This approach 
will also help develop innovative approaches to assessing risk and developing risk 
management strategies through avoiding reliance on the traditional patterns that drive risk 
analysis models. 
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E. FUTURE RESEARCH 

The field of homeland security continues to evolve, and the research for this thesis 
is not exhaustive. While this thesis contributes to the conversation on improving risk 
management, additional research will benefit the homeland security enterprise. 
Specifically, additional research should examine homeland security risk management 
practices within state and local government, risk analysis in complex adaptive systems, 
such as critical infrastructure protection, and risk management decision making within 
the homeland security enterprise. 
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